APNs certificate expired in Hexnode before enrolling company-owned iOS devices with Apple ConfiguratorSolved

Yes, @carter, you need to renew the APNs certificate before enrolling or managing iOS devices. Hexnode requires a valid Apple Push Notification service certificate to communicate with Apple devices. To renew the APNs certificate in Hexnode:

1. Go to Admin > APNs in the Hexnode portal.
2. Select Renew Certificate.
3. Click Generate CSR to download the certificate signing request from Hexnode.
4. Proceed to the Apple Push Certificates Portal from the renewal workflow.
5.  Sign in using the same Apple ID that was used to create the existing APNs certificate.
6. In the Apple portal, identify the correct certificate using its expiration date.
7. Click Renew for that certificate and upload the CSR downloaded from Hexnode.
8. Download the renewed APNs certificate in .pem format.
9. Return to Hexnode, upload the renewed certificate, and complete the renewal.

It is important to renew the existing APNs certificate instead of creating a new one. Creating a new APNs certificate can affect communication with already enrolled iOS devices.

Once APNs is renewed, you can proceed with Apple Configurator enrollment for company-owned iOS devices if Apple Business Manager is not being used.

I have more than one APNs certificate listed in the Apple Push Certificates Portal. Is the expiration date enough to identify the right one?

The expiration date shown in Hexnode can be used to match the certificate in the Apple Push Certificates Portal. Make sure you renew the certificate that corresponds to the one currently uploaded in Hexnode.

Also, use the same Apple ID that was originally used for generating the APNs certificate. If a different Apple ID is used or a new certificate is created instead of renewing the existing one, previously enrolled iOS devices may stop responding to management commands.

Got it. Renewing the existing APNs certificate first makes sense. After that I’ll continue with Apple Configurator enrollment since these are company-owned devices and we are not using ABM right now.