Renewing an APNs certificate in Hexnode without re-enrolling iOS devicesSolved

For an existing APNs certificate, you should renew the current certificate instead of creating a new one. Creating a new APNs certificate can break communication with already enrolled Apple devices. Use the following renewal flow:

1. In Hexnode, go to Admin > APNs Settings.

2. Click Renew Certificate.

3. Generate and download the Hexnode-signed CSR.

4. Open the Apple Push Certificates Portal.

5. Sign in using the same Apple Account that was used to create the existing APNs certificate.

6. Locate the correct certificate by matching the certificate details such as the UID and expiration date.

7. Click Renew for that certificate.

8. Upload the CSR generated from Hexnode.

9. Download the renewed APNs certificate in .pem format from Apple.

10. Return to Hexnode and upload the .pem file to complete the renewal.

The CSR upload option appears only after selecting Renew for the correct certificate in the Apple portal.

That makes sense. The part that confused me was that I expected to see an upload button immediately after signing in to the Apple portal. It only appeared once I clicked Renew on the certificate.

What happens if someone accidentally uses the wrong Apple Account and tries to upload that certificate back into Hexnode? Would all devices immediately need to be re-enrolled?

Hexnode validates the uploaded APNs certificate. If the certificate was generated using the wrong Apple Account and does not match the existing APNs certificate identity, Hexnode will prevent the upload and show an error indicating that the certificate must be generated using the original Apple Account. If the APNs setup is replaced incorrectly and devices lose MDM communication, the affected Apple devices would need to be re-enrolled. For Apple Business Manager devices that must remain supervised, this typically requires a factory reset followed by enrollment again.

Good to know there’s a validation check. For expiry alerts, where do I add more people so they also receive the APNs expiration emails?

APNs expiry notification emails are sent to the technicians configured in the Hexnode portal. To review or add technicians:

1. Go to Admin > Technicians and Roles.
2. Add the required users as technicians or admins.
3. Make sure the invited users activate their technician accounts.

Only activated technician accounts will receive these notifications. If you need someone to manage technician roles at the highest level, note that the Super Admin is the highest role in the portal. There can be only one Super Admin, and only the current Super Admin can promote another technician or admin to Super Admin while demoting their own role.