Apple TV VPP app install stuck with certificate or compatibility errorsSolved

Hello @akemi ,

Since you have already verified the VPP token and license counts, a common cause for this on tvOS is Single App Kiosk mode.

On tvOS, app updates or reinstalls cannot complete while the target application is actively running in the foreground. If the affected Apple TVs are running in Single App Kiosk mode, try the following:

1. Temporarily disassociate the Single App Kiosk policy from the affected devices.

2. Restart the Apple TVs.

3. Wait for the installation to complete, then reapply the kiosk profile.

If they are not in kiosk mode, or if removing the policy doesn’t resolve it, check the Action History on the device details page in Hexnode UEM for any specific error messages regarding the failed install command.

I did have them in Single App Kiosk mode initially, but removing the kiosk profile and rebooting didn’t allow the install to complete.

I checked the Action History for the failing devices, and it shows the install failed due to a certificate issue and app compatibility. I checked other failing devices and found similar certificate errors for different URLs.

Those specific Action History errors point directly to a network path issue rather than an actual app compatibility problem.

Certificate or compatibility errors during VPP app deployment typically occur when network filters, SSL inspection, or strict firewall rules block outbound communication to Apple’s deployment endpoints (such as apple.com). When those network requests are intercepted, the device fails to validate the server’s trust chain or download the necessary manifests, resulting in generic certificate and compatibility failure logs in Hexnode UEM.

Since the app installs successfully on identical Apple TVs at your other locations, it is highly likely that the affected sites have local firewall rules blocking Apple’s CDN traffic. Please review the network filters at the failing sites to ensure Apple’s required traffic is allowed.

Regards,
Simon Scott
Hexnode UEM

That ended up being it! The affected sites had firewall rules blocking traffic to Apple. Once the firewall was updated to allow the required Apple traffic, the VPP app started installing normally.