Skip to main content

Was upgrading my on prem dev Jamf pro instanace today and was looking into Important notices for the last few releases. I noticed this:

11.14.0

Apple announced upcoming changes to the Apple Push Notification service (APNs) Certificate Authority (CA). Organizations using APNs will be required to update their application's trust store to include the new server certificate before 24 February 2025 to prevent communication disruption.

For cloud-hosted environments, the root certificate is already trusted and validated.

For on-premise environments, you may need to download and install the new SHA-2 Root USERTrust RSA Certification Authority certificate to your server's certificate trust store if it is not already trusted on your hosting infrastructure. For more information, see How to Download & Install Sectigo Intermediate Certificates - RSA documentation from Sectigo per Apple's announcement.

Apple has a test server available to allow organizations to send push certificates to verify the correct certificate installation. For more information, see this documentation from the Apple Developer website.

 

Does this mean that the new SHA-2 Root USERTrust RSA Certification Authority certificate needs to be added to the our windows server cert store? I am not seening any APNS push issues in Dev or production. I wondering if apple might have removed the old cert yet?

you may need to download and install the new SHA-2 Root USERTrust RSA Certification Authority certificate to your server's certificate trust store if it is not already trusted on your hosting infrastructure.

 server's certificate trust store

 

Yes, you would add this to your Windows Servers Cert Store if you needed it at all. 

 

new server certificate before 24 February 2025 to prevent communication disruption.

I am not seening any APNS push issues in Dev or production.

 

I am figuring you are fine; this certificate is likely handled by Windows Server automatically if you keep it patched. Unfortunately many organizations do not keep their servers patched very well, and Linux Servers do Linux things so it’s best for the documentation to be out there just in case. Since you are not having issues, and this change was 5 months ago, I’d say its safe to assume you are fine.