APNS CA update

[stager0909]

Hello,
It seems that Apple is planning to change the CA for APNS.
Could you let me know what kind of actions I need to take in relation to this?
https://developer.apple.com/news/?id=09za8wzy

[jchambers]

The main thing here is exactly what Apple has put in the document you linked:

To ensure a smooth transition and avoid push notification delivery failures, please make sure that both old and new server certificates are included in the Trust Store before the cut-off date for each of your application servers that connect to sandbox and production.

To be a little more explicit, you can:

1. Download the certificate from the page linked from Apple's announcement. I am not providing a direct link because it is important that you verify that you've retrieved the certificate from a trusted, credible source and not from some random person on the internet.
2. Get the SHA256 fingerprint of the certificate. One way to do that is with openssl:

openssl x509 -in certificate.crt -noout -fingerprint -sha256

3. Check to see if you have a certificate with that fingerprint in your trust store. You can get a list of trusted certificates in the default trust store with keytool -list -cacerts. If you're using a custom trust store, the process is similar, but you need to specify the trust store with the -keystore argument. Please see the keytool documentation for more information.
4. If the new certificate is already present, you do not need to take any further action.
5. If the new certificate is not present, you'll need to either add it to your trust store or use one of the ApnsClient#setTrustedServerCertificateChain methods.

[c2ch]

OK, how do I know if this server certificate exists in my Jdk default trust store? How can I check and confirm it? The JDK I use is JDK8, which is too old (some objective factors make it impossible to upgrade). I am not very clear about this area. Thank you.

[jchambers]

how do I know if this server certificate exists in my Jdk default trust store?

@c2ch Please find instructions in the first post in this thread. If those are unclear, can you please explain why so I can try to clarify them?

[scapegoat4U]

@jchambers I would like to add that your directions are the most clear and straightforward that I've seen on this topic (in particular compared to Apple's) and thank you for providing them, which allowed me to test and determine correct operation with the sandbox server.

[PPericleous]

Hello there everyone. @jchambers what is confusing me is that i don't remember setting before a cert in the trusted store for this to work. Why we say that we need to update it ?

[jchambers]

i don't remember setting before a cert in the trusted store for this to work. Why we say that we need to update it ?

You probably didn't.

Unless you configure something else, Pushy uses the system-wide default trust store. The default trust store contains a number of well-known certificates. Yours probably contained the old root certificate, and so you didn't need to take any action. My guess is that your default trust store also contains the new certificate, which is well-known and widely-used, but you should check to make sure.