Apple Profile Manager - Remote Management profile not automatically updating

[meakjoe]

Hi all,

 

We're having an issue with our Apple Profile Manager. We can set up and manage iPads successfully, and deploy apps etc.

 

The problem comes exactly a year after the management profile has been installed and it expires, which stops our ability to manage the iPads and deploy apps. The only way to fix this is to physically connect the iPads to a Mac and reinstall the enrollment profile, which re-enrolls them for another year.

 

Has anyone else had this problem and knows what the issue is?

 

Thank you!

[Brimstone]

This is because you are not renewing the APNS Certificate, which with the DEP and VPP tokens must be renewed annually.

[meakjoe]

I'm pretty sure we do that every year when they expire. Surely without both of those being active then it wouldn't work at all to begin with?

[Brimstone]

I'm pretty sure we do that every year when they expire. Surely without both of those being active then it wouldn't work at all to begin with?

The APNS certificate is to allow your server to authenticate itself with Apple's servers, it therefore has no direct relevance to your iPads and this is why your iPads do not show it. You only get APNS traffic from Apple's servers not from your own server and your server only talks to Apple's APNS servers, i.e. Apple act as the intermediary.

The Device Identity certificate is generated by your Profile Manager when you enrol your iPad and thereafter is used to prove to your Profile Manager it is the genuine authorised device. Your Profile Manager server will have its own computer certificate which needs to be renewed before it expires.

Your Profile Manager server sends notifications via APNS to the Apple APNS servers and then the Apple APNS servers forward these to your devices. If your Profile Manager APNS certificate expires before you renew it then your devices can no get such notifications and not only will they no longer be able to get updates to profiles from your Profile Manager server but they will also not be able to renew their Device Identity certificates. If this happens you will have to re-enrol all your devices.

So you need to make sure you update both the APNS any any other certificates on your Profile Manager server before they expire i.e. the computer server certificate and the code-signing certificate both of which are only on your server.