If a user has uninstalled my app, how long will the APNS take to update that this device is inactive for the bundleID?
Heyo, after reading up a bunch to make the migration to the new APNS provider API, this is what seems most familiar to me regarding this:
Establishing a Certificate-Based Connection to APNs
"Check expiry of a certificate with KeyChain Access. To avoid a disruption in service for your users, update your provider certificates before they expire. Provider certificates are valid for a year and must be updated to continue communicating with APNs".
Also:
"If you think your certificate or private key has been compromised, you can revoke your certificate from your developer account. APNs maintains a list of revoked certificates, and it refuses TLS connections from servers whose certificates are on that list. If your server is using a revoked certificate, close all existing connections to APNs and configure a new provider certificate for your server before opening any new connections".
Seems to me it the expiry is based around certificate creation as well as deleting the app?
I'd like to hear more on this....
Related
I'm reading this article on iOS push certificates, and I'm confused about this paragraph:
Your backend sends notifications through Apple's servers to your application. To ensure that unwanted parties are not sending notifications to your application, Apple needs to know that only your servers can connect with theirs. Apple therefore requires you to create an SSL certificate to be able to send push notifications.
My understanding of SSL certificates is that if a server has one, that server is able to encrypt data that it sends to a device. But it says here Apple needs to know that only your servers can connect with theirs. I don't understand how having an SSL certificate ensures that. Does anyone have any insight?
The article shouldn't have used the term SSL Certificate. SSL is the Secure Sockets Layer (which was superseded by TLS many years ago). SSL and TLS define the handshake that is used to negotiate encryption on a connection.
Enabling SSL on a web server required you to have a certificate to verify your server's identity and so this became known colloquially as an "SSL certificate".
While it isn't often used on the web, in SSL/TLS both parties can present a certificate so that there is mutual authentication.
What you typically have is actually an x.509 certificate. This is the case with the push notification service.
An x.509 certificate contains some information including the identity of the certificate holder, their private key and a signature from a trusted party that can be used to verify the information.
For push notifications, the developer generates a certificate request and submits this to Apple who sign it with their private key. Apple is the trusted party in this case.
When this certificate is subsequently presented to Apple's server they can verify that signature using their public key to confirm the identity of the connecting party.
You have has encrypted the message with their private key (Apple can decrypt it with the public key included in the certificate).
What this means is, that as long as the developer has kept their private key secure (which is why you wouldn't connect directly to the push service from your app, for example) then Apple can be sure of the identity of the server making the connection.
If someone was trying to impersonate your server then, as long as you have kept your private key secure, they can't encrypt the data properly. If they use a forged certificate that uses a public/private key pair known to them then the signature on the certificate won't be valid and Apple will reject it.
I'm supporting one mobile application. Recently I got email that "apns production certificate will expiring soon". After that I checked my backend and found that no any certs using, only auth key. As I know auth keys don't have expiration key. I suppose that apns-cert used on first time after launch or maybe created mistakenly but not using right now. So I have couple of quesions:
1) For well-working APNS, should I have only auth key without APNS certificates? (My idea here - can I safely remove cert without hurting current APNS)?
2) If for example I have non-used in production APNS certificate - I still receive some notifications on my email - like "this certificate will expiring soon"?
Thanks in advance.
1) For well-working APNS, should I have only auth key without APNS
certificates? (My idea here - can I safely remove cert without hurting
current APNS)?
You can safely remove any expired APNS certificate if you are not using. They are not related to the Auth Keys.
2) If for example I have non-used in production APNS certificate - I
still receive some notifications on my email - like "this certificate
will expiring soon"?
Just because you created those certificates, so Apple notifies you of the expiry date whenever they are going to be expired.
You can reference to the following discussion for more details.
https://forums.developer.apple.com/thread/91891
My certificate expires in a month, my app uses push notifications so I need the certificate to be valid. If I revoke it and then create a new one will I have to upload an "update" for the app with the new certificate? or is easier if it expires first then I renew the certificate and then I'll need to generate again all the provisionings with the new certificate? I need to be sure about this before I revoke it, please help. Can someone share a link where I can verify this.
No, not at all. The certificate is for your server. You don't need to submit an app update by any means, simply revoke the certificate and request a new one, and then upload that certificate to your provider, whether that be Urban Airship :) or whomever. No downtime whatsoever to your current users.
I have my App in the AppStore which uses push notifications. I already have a valid certificate but it expires in a month. My question is "Is there any way to generate a permanent APNS certificate which doesn't expire"? I've to deploy server in client premises and don't have further access, so I need to generate a permanent APNS certificate.
No, it's not possible to generate a permanent certificate. A production APNS certificate is valid for 1 year. You will be able to generate a new certificate to replace the existing one before it expires.
The Application i am working on needs to connect to a webservice over https, The certificate is trusted and valid.
I have used NSURLConnection is previous projects to use soap over http
Can anybody please point the difference between the two above mentioned scenarios,
I also need to understand what exactly happens when connecting over https, is the certificate stored automatically on the device, how does ssl handshake happen.
Any Pointers in this direction will be really helpful.
Regards,
Ishan
I need some clarification. Is the certificate signed by Apple for use with notifications or is it signed by an SSL root certificate authority (like VeriSign)?
Apple signed certificates are only to be used with WebServer to Apple Server communications like the Apple Push Notification Service. They are not intended for iOS device to WebServer.
A SSL certificate signed by a SSL root certificate authority should just work.
I think you are looking for an HTTP over SSL/TLS primer. So, here it goes.
HTTP is an unencrypted channel. The request and response are in a plain text data stream. HTTPS is an encrypted channel. The request and response are in a data stream encrypted using a shared master key. The magic of SSL/TLS is how this encrypted channel is created.
First, the client and server say hello to each other (in a clear channel).
Next, the client downloads the server's public certificate (in a clear channel).
At this point, the client has some work to do. It needs to verify the certificate. It needs to know that it understands the certificate, that the date range is valid, that the certificate is signed by a trusted certificate authority, and that the certificate has not been revoked.
Now, the client knows that it can trust the server.
Next, It sends a few short messages encrypted with the public key of the server (which is in the server's public certificate). These messages can only be decrypted by the server's private key (which only the server knows about). These messages allow the client and the server to negotiate a master key.
Finally, the client and the server begin the normal HTTP request and response using the newly created encrypted channel.
I hope this is what you are looking for. For a more detailed description see: http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html
If the certificate was issued by a chain of certificate authorities whose root is trusted by Apple, then there is nothing to do. The iOS device will accept the certificate, as long as it is otherwise valid (ie not expired, not revoked, etc).
If the CA chain's root is not trusted by Apple, you will need to download the root's certificate to the phone. This can be done (I think) via the iPhone Configuration Utility. Enterprise provisioning scenarios undoubtedly support this also.