Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Excerpt
hiddentrue

Approved by: Sean Holden on  

Confluence/External link(s) used:

Description

Apple Mobile Device Management (MDM) requires an Apple Push Notification service (APNs) certificate; renewable yearly.

...

Info
titleCMD Commands

The cmd.exe application should be opened with 'Run as an Administrator' for all commands in this KB.

Information

Requirements

  • An appropriate copy of OpenSSL, which must be downloaded and installed.  

Note, the light version does not include the necessary configuration files.

Step-By-Step Guide

Table of Contents
maxLevel5
minLevel4

Creating the Certificate Signing Request (CSR)

  1. Open cmd.exe as an Administrator
  2. Create a CSR.  Enter the following command, which will result in two new files on the Desktop: request.csr and privateKey.key:

    Code Block
    languagepowershell
    "C:\Program Files\OpenSSL-Win64\bin\openssl.exe" req -out "%USERPROFILE%\Desktop\request.csr" -new -newkey rsa:2048 -nodes -keyout "%USERPROFILE%\Desktop\privateKey.key" -config "C:\Program Files\OpenSSL-Win64\bin\cnf\openssl.cnf"


    Tip

    Certificate Private Key names are visible from openssl commands and the Common Name is used to set the Private Key name.  Supplying the Apple ID and Server as the Common Name, ensures the Apple ID used to generate the certificate will be stored for future reference.


Sign the CSR

CSR requests must be signed before uploading to Apple.  FileWave has a portal for this process, which requires an active FileWave account.

  1. Navigate to https://csr.filewave.com/list_csr and login.
  2. Upload the previously created CSR.
  3. 'Download signed CSR' should list this uploaded and now signed CSR. 
  4. Download this newly signed CSR, ready for upload to Apple in the next section.  Again consider where this certificate is stored.

Upload the signed FileWave CSR to Apple

Section
bordertrue


Column
width50%
Creating a Certificate
  1. Navigate to: https://identity.apple.com/pushcert/ and log in with an Apple ID.

    Tip

    This Apple ID will own the certificate and is required for every renewal.  Do not use a personal Apple ID, to avoid complications if that person where to leave the business or institution.


  2. Click 'Create'.
  3. 'Accept' Apple's 'Terms of Use'.


Column
width50%
Renewing a Certificate
  1. Navigate to: https://identity.apple.com/pushcert/ and log in with the Apple ID used to initially create the certificate. 
  2. Confirm the Certificate to renew.
  3. Select 'Renew'.

To confirm the certificate, compare the Subject DN (Topic) and current certificate.

Clicking the 'i' button will show the certificate details, including the Topic:

Ensure this matches with the 'Current Certificate' in FileWave Admin > Preferences > Mobile > Apple Push Notification Certificate:

Warning

If the 'Topics' do not match do not continue.  If the correct certificate is not in the list on Apple's website, this is the wrong Apple ID. If this guide was followed in creating the original certificate, the previously used Apple ID will be viewable from the certificate "Private Key".



...

Click 'Download' and save the ".pem" file.  Again consider where this certificate is stored.


Create a ".p12" from the Signed CSR

  1. Open cmd.exe as an Administrator
  2. Create a ".p12".  Entering the following command will create the ".p12" on the Desktop:

    Code Block
    languagepowershell
    titleCombining APNs Certificate with Private Key, generating a ".p12"
    "C:\Program Files\OpenSSL-Win64\bin\openssl.exe" pkcs12 -export -in "%USERPROFILE%\Downloads\MDM_ FileWave (Europe) Gmbh_Certificate.pem" -inkey "%USERPROFILE%\Desktop\privateKey.key" -out "%USERPROFILE%\Desktop\push_cert.p12" -name fw-apns


  3. Leave the 'Export Password' blank

  4. Certificate details may be checked:

    Anchor
    openssl_show_p12
    openssl_show_p12

    Tip
    titleCommon Name and Topic

    The name of the Private Key will show the value defined as the "Common Name" from the creation of the CSR.  Where recommendation was followed, this should list the Apple ID and Server name.  Additionally the name of the Certificate is the same as the Topic.


    Code Block
    languagepowershell
    titleRead the created ".p12" file
    "C:\Program Files\OpenSSL-Win64\bin\openssl.exe" pkcs12 -info -in C:\Users\Administrator\Desktop\push_cert.p12

    Note, below image has been edited to remove some details and highlight the two key items of interest.


Uploading the Certificate into FileWave

  1. Launch the FileWave Admin and login to the FileWave server.
  2. Open the FileWave Admin žPreferences.
  3. Select the 'Mobile' tab.
  4. Click 'Browse' and navigate to the saved ".p12" APNs certificate.
  5. Select the exported ".p12" certficate.
  6. Click 'Upload APN Certificate/Key Pair'.
  7. The topic should match the previous topic.
  8. That is it! FileWave may now manage Apple devices using Apple’s Push Notification Service.

...

Tip

APNs certificates require yearly renewals.  Through FileWave Admin > Dashboard > Alert Settings, automated emails may configured.  Consider adding 'APN for MDM'.  Note this requires the Email preferences in Admin to be configured.


APNs Certificate Creation and Renewal on macOS

...