Does APNs cert renewal revoke the old cert?

[alexjdale]

When I renew an APNs cert, will the cert already in the JSS continue to work until its expiration date, or will it stop working as if it were revoked? I'm trying to write a detailed change/backout plan for this process and need to know this detail (not that I expect any problems).

If things go very wrong for some reason, I wonder if going back to the nightly backup would restore operation.

[sam_g]

The old one will simply be replaced - you shouldn't have anything to worry about.

Check out Jamf's KB video: https://www.youtube.com/watch?v=9l5ns2I2Fqg

[alexjdale]

I get that, I'm wondering if between the time that you renew the cert on Apple's portal and upload it to the JSS if the old one is "revoked" or if it can keep pushing. Otherwise there's a leap of faith at that point.

[Ryan_]

@alexjdale When the APNs cert is renewed in Jamf Pro it replaces the old cert with the new one.
It's a great idea to add a note by clicking the history button in the lower right when viewing the push cert in Jamf to notate which Apple ID was used to create that push certificate. The same Apple ID needs to be used to renew it each year.

If for some reason the wrong cert gets uploaded during the renewal it will display a warning not to continue as pictured:

Restoring to a database backup containing the correct push certificate will place that push certificate back in Jamf Pro.

[Ryan_]

@alexjdale The old cert does not get revoked during the renewal process. It's the same certificate just being renewed.

The certificate in Jamf Pro needs to match what is on the device and in Apple's push portal.

[alexjdale]

Thanks, we are going the "signed CSR from Jamfnation" route since our JSS is in a secure zone, which is why I was concerned about there being a gap of time where the cert was renewed from Apple but the JSS cert hasn't been replaced yet. It's not a likely scenario, but if the worst-case happens and my computer explodes right after I renew it or something like that, I needed to know if that would create downtime.