Apple devices need an APNs certificate before they can be managed. This article covers what the certificate does, how to create it, and the renewal that catches most teams out twelve months later.
Overview
The Apple Push Notification service (APNs) is how Factorial IT reaches Apple devices. Without it, there is no MDM on Apple at all.
The certificate is tied to your organisation and must be renewed every 12 months.
Once it is in place, APNs lets Factorial IT:
- Push configurations — encryption, firewall, updates, password rules, sleep settings, app installation, Wi-Fi
- Send commands in real time, even when the device is locked or asleep
- Communicate silently, with no action from the employee
How to use — create and import the certificate
- Get your CSR. Go to MDM > Apple and download the Certificate Signing Request file
- Open the Apple Push Certificates portal at identity.apple.com/pushcert (https://identity.apple.com/pushcert)
- Click Create a certificate and upload the CSR you just downloaded
- Sign in with your Apple ID. Use a shared Apple ID, not a personal one — see the warning below
- Download the certificate. Apple generates a .pem file
- Upload it back. Return to MDM > Apple and upload the file. Apple MDM is now operational
Use a shared Apple ID. The certificate is tied to the Apple ID that created it, and renewal requires that same account. If it belongs to someone who later leaves the company, you lose the ability to renew and every Apple device drops out of management.
How to use — renew the certificate
The certificate lasts 12 months. You are notified by email and a banner appears in the dashboard when renewal is due.
Repeat the steps above using the same Apple ID that created the original.
Tips and best practices
- Create the certificate with a shared Apple ID from day one. This is the single most expensive mistake to fix later: if the original account is gone, renewal is impossible and every Apple device has to be re-enrolled
- Put the renewal date in a shared calendar, not just in one person's inbox. The email and the banner both assume somebody is looking
- Record which Apple ID owns the certificate somewhere your team can find it in twelve months' time
- Renew before expiry, not after. Once it lapses, devices stop responding to commands until a new certificate is in place
Troubleshooting and FAQ
Troubleshooting
- Devices are not responding to commands. Check whether the APNs certificate has expired. Without a valid certificate there is no channel to reach Apple devices, and nothing else will fix it.
- Renewal is rejected. You are signed in with a different Apple ID from the one that created the certificate. Renewal only works with the original account.
- Nobody knows which Apple ID was used. If the account cannot be recovered, you have to create a new certificate — which means re-enrolling every Apple device. This is why a shared Apple ID matters.
FAQ
-
How often does the certificate need renewing?
Every 12 months, using the same Apple ID that created it.
-
What happens if it expires?
Apple devices stop receiving MDM commands until a valid certificate is uploaded.
-
Can we change the Apple ID later?
Not for an existing certificate. A different Apple ID means a new certificate and re-enrolling the devices.
-
Is a paid Apple Developer account needed?
No. Any Apple ID works, but it should be a shared organisational one.