> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Apple Push certificate migration overview

> Bring every Apple device back onto one Apple Push certificate after a certificate was created again instead of renewed: what went wrong, the order to follow, and where each step is documented.

An Apple device only receives MDM commands through the Apple Push certificate it enrolled under. When a company creates a new certificate instead of renewing the existing one, or renews it with another Apple Account, the devices enrolled before keep the old certificate and stop receiving commands. These pages explain how to recognize the problem, choose the certificate to keep, and move each device onto it.

To renew a certificate the right way, see [Renew your APNs certificate](https://docs.getprimo.com/mdm/get-started/set-up-apn-certificate.md#renew-your-apns-certificate).

> [card] [Diagnose](https://docs.getprimo.com/mdm/guides/apple-push/diagnose.md)
>
> Confirm which devices sit on another certificate by comparing their APNs topic with the installed one.

> [card] [Choose a certificate](https://docs.getprimo.com/mdm/guides/apple-push/choose-certificate.md)
>
> Decide between keeping the new certificate and returning to the original one.

> [card] [Renew the original](https://docs.getprimo.com/mdm/guides/apple-push/renew-original-certificate.md)
>
> Renew the original certificate with its Apple Account and install it in Fleet.

> [card] [Move devices](https://docs.getprimo.com/mdm/guides/apple-push/move-devices.md)
>
> Move each Mac, iPhone, and iPad onto the kept certificate, and check that it arrived.

> [card] [Migration agent](https://docs.getprimo.com/mdm/guides/apple-push/migration-agent.md)
>
> Let Primo AI follow the migration, open the tickets, and report progress.

> [card] [Troubleshooting](https://docs.getprimo.com/mdm/guides/apple-push/troubleshooting.md)
>
> Unblock a device that does not move, and answer the common questions.

## Key concepts

* **Apple Push certificate topic**: the identifier of a certificate, in the form `com.apple.mgmt.External.<uuid>`. Each device keeps the topic of the certificate it enrolled under, and only receives MDM commands under that topic.
* **Installed certificate**: the certificate Primo uses to send commands. Its topic shows in **MDM > Settings**, in the **Apple** window, next to **Installed certificate topic**.
* **Kept certificate**: the certificate every device ends up on. It is either the new certificate, already installed, or the original one, installed again.
* **Enrollment profile cache**: the enrollment profiles and packages Primo keeps ready. They carry the topic of the certificate installed when they were built. See [Purge the enrollment profile cache](https://docs.getprimo.com/mdm/settings#purge-the-enrollment-profile-cache).
* **Turn off MDM**: removes the MDM profile from a device. On a Mac, the Primo agent stays installed and keeps reporting. This is not the cockpit's **Unenroll** action, which also removes the Primo agent: never use **Unenroll** for this migration.

## Follow the order of operations

Every migration follows the same order, whichever certificate you keep.

**1. Install the kept certificate**

If you keep the new certificate, it is already installed. If you return to the original one, [renew it and install it in Fleet](https://docs.getprimo.com/mdm/guides/apple-push/renew-original-certificate.md).

**2. Purge the enrollment profile cache**

The next enrollment then rebuilds the profiles with the kept certificate. See [Purge the enrollment profile cache](https://docs.getprimo.com/mdm/settings#purge-the-enrollment-profile-cache).

**3. Turn off MDM on the devices to move**

Only on the devices whose **APNs topic** differs from the installed certificate topic.

**4. Re-enroll each device**

Each type of device re-enrolls in its own way. See [Move devices to the kept certificate](https://docs.getprimo.com/mdm/guides/apple-push/move-devices.md).

> [!WARNING]
>
> Never turn off MDM before the kept certificate is installed and the cache is purged. A device turned off too early re-enrolls on the certificate you are giving up, and you have to move it a second time.

This order has a cost. A **Turn off MDM** command sent to a device on another certificate cannot reach it through Apple Push: it waits in the queue until the device connects by itself. Turning off MDM therefore takes longer to reach the devices, and some may need an action from the employee.

## Next steps

> [card] [Diagnose](https://docs.getprimo.com/mdm/guides/apple-push/diagnose.md)
>
> Start by counting the devices on each certificate.

> [card] [Choose a certificate](https://docs.getprimo.com/mdm/guides/apple-push/choose-certificate.md)
>
> Then pick the certificate that moves the fewest devices.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.