Skip to main content
When part of your Apple devices stop receiving MDM commands after a certificate renewal, the cause is often a certificate created again instead of renewed. This article shows how to confirm it, device by device. If every Apple device stopped at once, the certificate has more likely expired: see Renew your APNs certificate.

​
Understand the Apple Push certificate topic

Each Apple Push certificate has a topic, in the form com.apple.mgmt.External.<uuid>. A renewal keeps the topic. A new certificate, or a certificate created with another Apple Account, gets a new topic. A device enrolls under the topic of the certificate installed at that moment, and keeps it. It only receives MDM commands sent under that topic. So once a certificate with another topic is installed, the devices enrolled before can no longer be reached.

​
Identify common causes

  • A new certificate was created instead of renewed: someone clicked Create a Certificate in the Apple Push Certificates Portal instead of Renew.
  • The certificate was renewed with another Apple Account: the original certificate only shows under the Apple Account that created it. Another account can only create a new one.

​
Recognize the symptoms

  • MDM commands stay Pending and never reach the device.
  • iPhones and iPads stop responding: no new profile, no lock, no wipe.
  • Macs keep reporting to Primo, because the Primo agent does not need Apple Push, but MDM commands no longer reach them.
  • Devices enrolled after the certificate change work, while the older ones do not.
  • Since Fleet 4.93.2, every push to these devices is refused with the error 400 TopicDisallowed. [À VÉRIFIER : où l’admin voit cette erreur dans Fleet.]

​
Verify the situation

1

Read the installed certificate topic

Go to MDM > Settings, then click Apple in the Platforms section. Under Apple Push Notification (APN) certificate, Installed certificate topic shows the first 8 characters of the topic. Hover it to see the whole topic.
2

Show the APNs topic column

In Devices, add the APNs topic column from the column picker. It shows the start of the topic each device enrolled under. Click a value to copy the whole topic. The value is available even when the device is off.
3

Compare each device with the installed topic

A company can have more than two topics if certificates were created several times. Note each topic you find.
4

Count the devices on each certificate

For each topic, count the Macs, iPhones, and iPads, and split each count between zero-touch deployment and manual enrollment. These counts decide which certificate to keep: see Choose which certificate to keep.

​
What if a device’s APNs topic is empty?

The device is not on any certificate, so it is not affected by the migration. If it should be managed, enroll it again: it enrolls on the installed certificate.

​
Contact

If the topics do not match what you expect, contact support@getprimo.com with:
  • the installed certificate topic
  • the number of Macs, iPhones, and iPads on each topic, split between zero-touch deployment and manual enrollment
  • the date of the certificate change and the Apple Accounts used