Profile Manager and MDM Certificate Expiration

I mean any of the certificates on your Profile Manager server so this means any of the following which are due to expire.

1. APNS certificate
2. Server SSL certificate
3. Server Code-signing certificate

As long as these are all valid the client device should keep in communication with the Profile Manager server and auto-renew its own identity certificate.

The APNS certificate is to allow your server to authenticate itself with Apple's servers, it therefore has no direct relevance to your iPads and this is why your iPads do not show it. You only get APNS traffic from Apple's servers not from your own server and your server only talks to Apple's APNS servers, i.e. Apple act as the intermediary.

The Device Identity certificate is generated by your Profile Manager when you enrol your iPad and thereafter is used to prove to your Profile Manager it is the genuine authorised device. Your Profile Manager server will have its own computer certificate which needs to be renewed before it expires.

Your Profile Manager server sends notifications via APNS to the Apple APNS servers and then the Apple APNS servers forward these to your devices. If your Profile Manager APNS certificate expires before you renew it then your devices can no get such notifications and not only will they no longer be able to get updates to profiles from your Profile Manager server but they will also not be able to renew their Device Identity certificates. If this happens you will have to re-enrol all your devices.

So you need to make sure you update both the APNS any any other certificates on your Profile Manager server before they expire i.e. the computer server certificate and the code-signing certificate both of which are only on your server.

chazman113 wrote:

That sounds about on par with my understanding, thanks. I believe from your explanation you are implying that the Profile Manager / Ipad will automatically renew their device identity certificate on the device via some mechanism as long as APNS is working? What would happen if an ipad was shut off and didn't renew after it's expiration period?

That's a concern I also have and don't know definitely what would happen.

I therefore normally renew at least 2-weeks in advance to give all devices time to check-in. This does mean that over several years the expiry date keeps moving earlier in time.