An enrolled iPad is showing up in Hexnode, but it does not look fully managed in the Hexnode app. Some management options are missing or unavailable, including actions like scanning the device and clearing the passcode. The enrollment appears to have completed, but the device is not responding like a fully managed iPad. What should be checked first?
iPad enrolled in Hexnode but not fully managed after APNs certificate expiredSolved
Replies (3)
Hi @astrid-,
This behavior can occur if the APNs certificate associated with the Hexnode portal has expired.
For iOS and iPadOS devices, Hexnode uses the Apple Push Notification service certificate to maintain MDM communication with enrolled devices. If the APNs certificate expires, the devices may still appear enrolled, but MDM commands such as Scan Device, Clear Passcode, app actions, and other remote management actions may not work as expected.
To restore communication, renew the APNs certificate:
- In the Hexnode portal, go to Admin > APNs.
- Select Renew certificate.
- Continue the renewal workflow and download the required certificate signing request from Hexnode.
- Sign in to the Apple Push Certificates Portal using the same Apple ID that was used to create the original APNs certificate.
- Renew the existing APNs certificate, download the renewed certificate, and upload it back to Hexnode.
Make sure the existing APNs certificate is renewed. Do not create a new APNs certificate unless you are prepared to re-enroll the Apple devices, because a different APNs certificate can break management for already enrolled devices.
Regards,
Isabel Lora
Hexnode UEM
If the APNs certificate has already expired, does renewing it still restore management, or do all iPads have to be enrolled again?
Renewing the same APNs certificate should restore MDM communication, even if it has expired, as long as the renewal is done from the same Apple ID and the original certificate is renewed.
Re-enrollment is usually required only if a new APNs certificate is created and uploaded instead of renewing the existing one. In that case, the APNs topic changes, and already enrolled Apple devices will no longer trust the MDM communication path.
After completing the renewal, allow the device some time to check in, then try a Scan Device action or another remote command to confirm that management has been restored.
Regards,
Isabel Lora
Hexnode UEM