> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Diagnose devices on another Apple Push certificate

> Recognize the symptoms of a certificate created instead of renewed, and confirm which devices sit on another Apple Push certificate by comparing their APNs topic with the installed one.

When part of your Apple devices stop receiving MDM commands after a certificate renewal, the cause is often a certificate created again instead of renewed. This article shows how to confirm it, device by device. If every Apple device stopped at once, the certificate has more likely expired: see [Renew your APNs certificate](https://docs.getprimo.com/mdm/get-started/set-up-apn-certificate.md#renew-your-apns-certificate).

## Understand the Apple Push certificate topic

Each Apple Push certificate has a topic, in the form `com.apple.mgmt.External.<uuid>`. A renewal keeps the topic. A new certificate, or a certificate created with another Apple Account, gets a new topic.

A device enrolls under the topic of the certificate installed at that moment, and keeps it. It only receives MDM commands sent under that topic. So once a certificate with another topic is installed, the devices enrolled before can no longer be reached.

## Identify common causes

* **A new certificate was created instead of renewed**: someone clicked **Create a Certificate** in the Apple Push Certificates Portal instead of **Renew**.
* **The certificate was renewed with another Apple Account**: the original certificate only shows under the Apple Account that created it. Another account can only create a new one.

## Recognize the symptoms

* MDM commands stay **Pending** and never reach the device.
* iPhones and iPads stop responding: no new profile, no lock, no wipe.
* Macs keep reporting to Primo, because the Primo agent does not need Apple Push, but MDM commands no longer reach them.
* Devices enrolled after the certificate change work, while the older ones do not.
* Since Fleet 4.93.2, every push to these devices is refused with the error `400 TopicDisallowed`. **\[À VÉRIFIER : où l'admin voit cette erreur dans Fleet.]**

## Verify the situation

**1. Read the installed certificate topic**

Go to **MDM > Settings**, then click **Apple** in the **Platforms** section. Under **Apple Push Notification (APN) certificate**, **Installed certificate topic** shows the first 8 characters of the topic. Hover it to see the whole topic.

**2. Show the APNs topic column**

In **Devices**, add the **APNs topic** column from the column picker. It shows the start of the topic each device enrolled under. Click a value to copy the whole topic. The value is available even when the device is off.

**3. Compare each device with the installed topic**

| APNs topic of the device | What it means |
| - | - |
| Same as **Installed certificate topic** | The device receives MDM commands. Nothing to do. |
| Different from **Installed certificate topic** | The device sits on another certificate and no longer receives MDM commands. |
| Empty | The device has no certificate: it is not enrolled in MDM, or was unenrolled. |

A company can have more than two topics if certificates were created several times. Note each topic you find.

**4. Count the devices on each certificate**

For each topic, count the Macs, iPhones, and iPads, and split each count between zero-touch deployment and manual enrollment. These counts decide which certificate to keep: see [Choose which certificate to keep](https://docs.getprimo.com/mdm/guides/apple-push/choose-certificate.md).

## What if a device's APNs topic is empty?

The device is not on any certificate, so it is not affected by the migration. If it should be managed, enroll it again: it enrolls on the installed certificate.

## Contact

If the topics do not match what you expect, contact [support@getprimo.com](mailto:support@getprimo.com) with:

* the installed certificate topic
* the number of Macs, iPhones, and iPads on each topic, split between zero-touch deployment and manual enrollment
* the date of the certificate change and the Apple Accounts used

## Related articles

* [Apple Push certificate migration overview](https://docs.getprimo.com/mdm/guides/apple-push/overview.md)
* [Choose which Apple Push certificate to keep](https://docs.getprimo.com/mdm/guides/apple-push/choose-certificate.md)
* [Apple Push certificate setup and renewal](https://docs.getprimo.com/mdm/get-started/set-up-apn-certificate.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.