Certificate renewal no longer working

[Tyr3al]

Hi there,

it seems like the certificate renewal is no longer working. Every time I try to start the service, it now crashes with the following error message.

Oct 31 23:50:10 mail xapsd[1332757]: time="2024-10-31T23:50:10+01:00" level=warning msg="Certificate not valid after 2024-11-06 07:30:14 +0000 UTC - renewing..."
Oct 31 23:50:11 mail xapsd[1332757]: 2024/10/31 23:50:11 Error -80010 while retrieving certificates:
Oct 31 23:50:11 mail xapsd[1332757]: {Response:{Status:{ErrorDescription: ErrorMessage:ServiceType is Invalid. ErrorCode:-80010} Certificates:[]} Header:{ClientIPAddress:1 LanguagePreference:1 TransactionId:1 ClientOSVersion:2.1 ClientOSName:MAC OSX ClientApplicationName:XServer ClientApplicationCredential:1}}

Maybe apple has stopped allowing the creation of OSX Server certificates?

[freswa]

As of October 29, 2024, Profile Manager will no longer be able to create or renew push notification certificates for device management, however, existing certificates will continue to function. To help you migrate from Profile Manager to other MDM solutions, learn about choosing an MDM solution and planning your MDM migration.

From https://support.apple.com/en-us/101601.

Since all certificates share the same API endpoint, you're probably right.

[pbobbenb]

What does this mean? Can it be fixed or is it game over?
Also, can the automatic renewal be turned off?
Since I can't have the daemon running when it just crashes/relaunches over and over...

[freswa]

Game over.

[pbobbenb]

Game over for just the auto renewal function or for the whole project?

[freswa]

Without certificates there is no way to send push notifications anymore. If you find another way to get valid APN certificates, I'm happy to implement it.

[FreelancerJay]

Irk, is this the end? Nothing found so far to keep this going?

[freswa]

No, nothing has been found as of today. PRs and ideas welcome.

[FreelancerJay]

I’ll play around a bit in the coming week or two. Troubleshooting a weird crash in my dovecot for the moment but once I’ve nipped that I’ll give this my full attention.
Ping me if you need a tester for anything you find :-)

[FreelancerJay]

Just did a OS X El Capitan install and downloaded Server.app. Seemed to register push certificates fine. Reason for hope, or am I mis-interpreting what I managed here?

[skabmedia]

Tried it again on my emulated High Sierra I made just for the certs, and it seems to be working again!

So maybe it was just a fluke, maybe they disabled it on purpose but enough people complained, I don't care, it works again, at least for the moment, at least for another year.

[Tyr3al]

Tried it again on my emulated High Sierra I made just for the certs, and it seems to be working again!

xapsd was able to generate new certificates as well!

So maybe it was just a fluke, maybe they disabled it on purpose but enough people complained, I don't care, it works again, at least for the moment, at least for another year.

Good question. The support website does not mention any changes.

[orlovnv]

Good news, I can update certificete, but push doesn't work. I make fresh install.

[thefl0yd]

I was able to force my install to fetch a new cert (backed up and removed database.json) and confirmed all works as expected. 🤞 this continues to work as I was really starting to worry about what I'd migrate to next (I guess z-push).

[mstilkerich]

Good news, I can update certificete, but push doesn't work. I make fresh install.

I can second this. Creating a new cert works, but the push notifications don't come through. If I change the database file back to the previous certificates push works fine again. It seems the Apple server is not accepting these newly generated certificates.

Edit: What seemed to help is deleting also the Users registrations from the database.json. After my phone has registered freshly, it receives the push notifications also with the new certificate. Maybe the registration is somehow bound to the certificate?! Anyway, seems to work again and happy to have a certificate for at another year now.