Approved by: Sean Holden on
Confluence/External link(s) used:
Apple Mobile Device Management (MDM) requires an Apple Push Notification service (APNs) certificate; renewable yearly.
An APNs certificate has a unique topic, in the form of a hexadecimal string, and belongs to the Apple ID used to create the certificate. When renewing, the topic must match to ensure devices continue to communicate with the server. As such, not only must the same Apple ID be used when renewing an APNs certificate, but the current certificate must also be selected for renewal.
|Table of Contents|
Creating the Certificate Signing Request (CSR)
- Open Keychain Access, located in: Applications > Utilities > Keychain Access.app.
- Create a CSR. Keychain Access > Certificate Assistant > Request a Certificate from a Certificate Authority...
Enter the AppleID and Server name that you are going to be associating with this certificate in the "Common Name" field.
Tip title Common Name
Certificate Private Key names are visible in Keychain and the Common Name is used to set the Private Key name. Supplying the Apple ID and Server as the Common Name, ensures the Apple ID used to generate the certificate will be stored for future reference.
- Select the radio button "Saved to disk" and click Continue.
Save the CSR request, ready to upload to FileWave in the next section.
Tip title Certificate Storage
Consider creating a secure location to store the created certificates and sub divide them using the date or year, e.g folder named: 'MDM APNs certificates 2020'.
Sign the CSR
CSR requests must be signed before uploading to Apple. FileWave has a portal for this process, which requires an active FileWave account.
- Navigate to https://csr.filewave.com/list_csr and login.
- Upload the previously created CSR.
- 'Download signed CSR' should list this uploaded and now signed CSR.
- Download this newly signed CSR, ready for upload to Apple in the next section. Again consider where this certificate is stored.
Upload the signed FileWave CSR to Apple
Click 'Download' and save the ".pem" file. Again consider where this certificate is stored.
Create a ".p12" from the Signed CSR
Navigate to the downloaded ".pem" file and double-click to open in Keychain Access. It should appear in the 'login' Keychain.
Warning title Keychain
If imported into the System Keychain, the Private Key will not be accessible.
- Select the 'login' keychain in the upper left panel and 'My Certificates' category in the lower left panel.
- Locate the imported certificate. It will begin with "APSP:".
Click the disclosure triangle and select the expanded private key.
Anchor KeychainPrivateKey KeychainPrivateKey Tip title Common Name and Topic
The name of the Private Key will show the value defined as the "Common Name" from the creation of the CSR. Where recommendation was followed, this should list the Apple ID and Server name. Additionally the name of the Certificate is the same as the Topic.
- From the 'File' menu, choose 'Export Items...'.
- Export as a .p12 file. Again consider where this certificate is stored.
- Click Save.
- Leave the password blank.
- Enter your local admin account, when prompted, allowing Keychain to export.
Uploading the Certificate into FileWave
- Launch the FileWave Admin and login to the FileWave server.
- Open the FileWave Admin Preferences.
- Select the 'Mobile' tab.
- Click 'Browse' and navigate to the saved ".p12" APNs certificate.
- Select the exported ".p12" certficate.
- Click 'Upload APN Certificate/Key Pair'.
- The topic should match the previous topic.
- That is it! FileWave may now manage Apple devices using Apple’s Push Notification Service.
APNs certificates require yearly renewals. Through FileWave Admin > Dashboard > Alert Settings, automated emails may configured. Consider adding 'APN for MDM'. Note this requires the Email preferences in Admin to be configured.