Apple Push Notification service (APNS) certificates enable Mobile Guardian to securely communicate with and manage your Apple fleet (enforcing restrictions, pushing apps, and executing remote commands). An APNS certificate is required to manage more than 10 iOS, iPadOS, or macOS devices.
Important: APNS certificates expire annually. When renewing, you must use the same Apple ID used during initial setup. Generating a completely new certificate instead of renewing will require all managed devices to be unenrolled and re-enrolled.
Prerequisites
- An active Mobile Guardian Administrator account.
- A dedicated organisation Apple ID (e.g., it-admin@yourdomain.com).
Download the Certificate Signing Request (CSR)
- Log in to the Mobile Guardian Dashboard.
- Select Settings from the left navigation panel, then click iOS MDM Settings.
- On the right side of the page, click the link to download your Certificate Signing Request (CSR).
- Save the Mobile_Guardian_APNS.csr file to your computer.
Generate the APNS Certificate via Apple
Open the Apple Push Certificates Portal in a new browser tab.
- Sign in using your organization's Apple ID.
- Click Create a Certificate and accept Apple’s Terms of Use.
- Click Choose File, select the Mobile_Guardian_APNS.csr file downloaded in Step 1, and click Upload.
In the Notes field on Apple's portal, type your school or organisation name for easy identification during annual renewals.
- Once generated, click Download on the confirmation screen to save your .pem certificate file.
Upload the Certificate to Mobile Guardian
- Return to the Mobile Guardian Dashboard (Settings > iOS MDM Settings).
- Click Update/Renew Certificate.
- In the pop-up window:
- Enter the Apple ID email address used to create the certificate.
- Click Select Certificate and attach the .pem file downloaded from Apple.
- Click Update Certificate.
A success notification will appear in the top-right corner, and your active certificate details will populate on the dashboard.
Maintenance & Best Practices
- Annual Renewal: Certificates must be renewed every 365 days. Mobile Guardian provides automated dashboard reminders prior to expiration.
- Renewal vs. Replacement: Always log in with the exact same Apple ID and renew the existing certificate entry. Uploading a newly created certificate key pair breaks the management trust relationship, requiring a full device re-enrollment across your fleet.