The Apple iOS Push Certificate must be renewed every year. If the certificate expires (or is revoked) all devices must be re-enrolled in Afaria. Something you want to avoid at any cost.

This blog will show you how to do this for a single Afaria 7 (SP 08) installation on Windows (Server 2008 R2). The information this post relies on is spread over following SAP knowledgebase articles:

• #7958
• #7779
• #7823

Renewing the iOS Push Certificate

Create a certificate request

We begin with creating a certificate request. I usually do this on the Afaria machine, but any machine will do.

1. Open IIS and navigate to <Machine Name> -> Server Certificates
   
   
   
   
2. On the “Server Certificates” screen press „Create Certificate Request“ on the right side
3. On the “Request Certificate” popup enter the values appropriate for your organization, e.g.
   
   
   
   
4. In the next screen leave the „Cryptographic service provider“ untouched, just change „Bit length“ to 2048
5. Finish the certificate request by saving it to a text file.

Get the certificate request signed

The next step is to get the certificate request signed on the Sybase site.

1. With your preferred web browser navigate to https://frontline.sybase.com/support and log in using your Sybase Mobile Technical Support Account
2. On the left side navigation go to “Apple CSR Signing”
3. Using the Web-UI select the certificate request file created earlier and upload it. 
   
   
   
   
4. Now the signed certificate request (SCSR) file will be presented for download. Download it and proceed to the next step

Renew the iOS Push certificate with the signed certificate request

With the SCSR file we are now able to renew the iOS Push certificate on the apple site.

1. Using a compatible browser (Safari should work best) navigate to https://identity.apple.com/pushcert and log in using your Apple ID
2. In the next screen identify your current push certificate. If you have multiple certificates you can identify the correct one by pressing the “i” button left to the “Renew” button 
   
   
   
   
3. Press „Renew“ on the push certificate you want to renew.
4. In the next screen select the SCSR file created before and upload it
   
   
   
   
5. You will be presented to download the new push certificate. Download the .pem file and complete the certificate request

Complete the certificate request

With the renewed push certificate (.pem) file continue on the same machine you created the certificate request.

1. Open IIS and go to <Machine Name> -> Server Certificates
2. Press “Complete Certificate Request”
3. Select the downloaded .pem file from before and enter a friendly name for the certificate
   
   
   
   
4. Back in the “Server Certificate” screen the new push certificate can be seen. Right click it and select “Export”
5. Export the certificate to a .pfx file

If you did not do the renew certificate procedure on your Afaria machine you will need to import this certificate (.pfx file) to the personal certificate store on your Afaria machine.

Adjust security settings on the new Push Certificate

In case you get an “unsigned Config Payload” presented during iOS device enrolment you need to do the following:

1. On the Afaria machine open mmc.exe
2. Add the Snap-in for “Certificates”, “Computer account”, “local Computer”
3. Open the “Personal” store
4. Identify your new iOS Push Certificate, right click on it -> All Tasks -> Manage Private Keys
5. In the popup add the local IIS_IUSRS account
   
   
   
   
6. Change the permission for the IIS_IUSRS account to “Read”
   
   
   
   
7. Press “Apply” and close the popup.
8. Do an IIS reset or restart the machine.

Integrate the renewed certificate in Afaria

Almost done, we only need to integrate the new push certificate into Afaria.

1. Log into Afaria Administrator
2. Go to Server -> Configuration -> Component -> iOS Notification (may differ depending on Afaria version)
3. In the “APNS Push Certificate” Area press “Browse” and select the exported push certificate (.pfx file) from before.
4. Enter the password for the .pfx file and press “Install”
   
   
   
   
5. Before saving your changes make sure you validate the installed certificate. Check the expiration date
   
   
   
   
6. Save your changes and restart the Afaria server (It would not hurt to restart the whole machine)

Now you are done renewing the Apple iOS Push Certificate for your Afaria installation. It is a long and complex process, but with this step-by-step instructions, you should be able to do it.