APNS Push Certificates

To communicate with Apple devices via MDM, Relution requires a signed APNS push certificate → (Apple Push Notification service). This certificate is linked to an Apple ID and must be renewed before it expires.
If a certificate expires, all enrolled Apple devices lose their MDM connection and must be re-enrolled.

Migration from the Previous Process #

If the Relution installation was set up prior to version 26.3.0 and a certificate was previously provided by sending a CSR to Relution Support, a one-time migration must be performed before using the Self-Service Wizard.

Navigate to Settings > Organization Certificates. If a migration is available for the organization, an information box with a button labeled Migrate old APNS certificate appears. Click it.

The migration is instantaneous and safe: it has no impact on enrolled devices or ongoing MDM communication. It simply updates how the certificate is stored internally within Relution. After the migration, the Self-Service Wizard can be used for all future certificate renewals.

Setting Up or Renewing a Certificate #

Navigate to Settings > Organization Certificates and click Start in the APNS section.

This opens the APNS Certificate Wizard.

1. Download Signed CSR #

Relution automatically generates and signs a Certificate Signing Request (CSR). Click Download to save it. Wait for the download to complete before clicking Next.

2. Upload Apple Push Certificate #

Open the Apple Push Certificates Portal → and sign in with the Apple Account.

• Renewing an existing certificate: Locate the certificate in the list and click Renew. Upload the CSR file from Step 1. This preserves the push topic, so enrolled devices do not need to be re-enrolled.
• New installation: Click Create a Certificate and upload the CSR file.

Download the .pem certificate file from the Apple portal.

Enter the Apple Account that generated the certificate into the free-text field.

Upload the certificate into Relution using the file uploader in this step.

The active push topic is displayed above the file uploader. Confirm that the correct certificate is being renewed — the push topic of the uploaded certificate should match the one displayed.

• If the push topic matches, click Save — the wizard is complete.
• If the push topic has changed, the wizard proceeds to Step 3.

3. Confirm Certificate Change (Only in Case of Push Topic Conflict) #

This step only appears if the uploaded certificate has a different push topic than the current one. This can happen if a new certificate was created instead of renewing the existing one, or if a different Apple ID was used.

The wizard displays the old and new push topics. To confirm the change:

1. Check the Yes, I want to update the certificate checkbox to confirm.

Click Save to apply the change.

Certificate Expiration and Renewal #

The Organization Certificates page displays the expiration date of the active certificate. Relution issues a warning as the expiration date approaches.

Renew the certificate before it expires. If the deadline is missed:

• All enrolled Apple devices instantly lose their MDM connection.
• Devices must be re-enrolled after the renewed certificate is uploaded.

Notes #

• Always use the same Apple ID when renewing a certificate. Using a different Apple ID creates a new push topic and requires a full re-enrollment of all devices.

• Always renew the existing certificate instead of creating a new one. Uploading a certificate with a different push topic causes enrolled devices to continue using the old certificate until it expires — after that, they must be re-enrolled.

• If a certificate expires, all enrolled Apple devices lose their MDM connection and must be re-enrolled.