> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Choose which Apple Push certificate to keep

> Compare keeping the new Apple Push certificate with returning to the original one, and choose based on access to the original Apple Account and the devices each option moves.

Every device must end up on one certificate. Whichever you keep, the devices on the other one have to move. Before choosing, count the devices on each certificate: see [Diagnose devices on another Apple Push certificate](https://docs.getprimo.com/mdm/guides/apple-push/diagnose.md).

## By option

| Option | Requires | Certificate change | Devices to move |
| - | - | - | - |
| **Keep the new certificate** | Nothing | None: the new certificate is already installed | The devices on the original certificate |
| **Return to the original certificate** | Access to the Apple Account that created the original certificate | [Renew the original certificate and install it in Fleet](https://docs.getprimo.com/mdm/guides/apple-push/renew-original-certificate.md) | The devices on the new certificate |

## Check access to the original Apple Account

This is the first criterion. The original certificate can only be renewed with the Apple Account that created it. If nobody can sign in with that account anymore, keeping the new certificate is the only option.

## Weigh the devices to move

If you still have access to the original Apple Account, compare what each option moves. Moving a device costs more or less depending on its type, from the heaviest to the lightest:

| Device | What moving it takes |
| - | - |
| iPhone or iPad, zero-touch deployment | An erase of the device: the employee loses what is not backed up, and Activation Lock asks for their Apple Account |
| iPhone or iPad, manual enrollment | The employee removes the MDM profile and installs the new one |
| Mac, zero-touch deployment | MDM turned off, then the employee accepts the re-enrollment window |
| Mac, manual enrollment | The MDM profile removed, then a guided re-enrollment where the employee types their administrator password |

Choose the option that moves the fewest heavy devices. For example, if the original certificate still holds most of your zero-touch iPhones, returning to it avoids erasing them, even if it means moving more Macs.

> [!NOTE]
>
> When you return to the original certificate, an alternative to erasing zero-touch iPhones and iPads exists in Apple Business. It is not the recommended route. See [Unassign and reassign devices in Apple Business](https://docs.getprimo.com/mdm/guides/apple-push/apple-business.md).

## Next steps

> [card] [Renew the original](https://docs.getprimo.com/mdm/guides/apple-push/renew-original-certificate.md)
>
> If you return to the original certificate, install it first.

> [card] [Move devices](https://docs.getprimo.com/mdm/guides/apple-push/move-devices.md)
>
> If you keep the new certificate, purge the cache and move the devices.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.