iOS MDM APNs Certificate

[SuRam]

Hey

I'm looking at various MDM providers for managing iOS devices.

Why does Meraki want us to create the .pem file from Apple Certificate Portal. I don't see any use to it. I suppose they can have the .pem file created themselves with their Apple ID and let the customers use it. This way we need not worry about renewal every year.

Can this be supported?

[MilesMeraki]

The .pem file relays to a certificate which allows the Apple Push notification server to communicate with SM. The certificate is then installed silently on enrolled SM devices to allow for management. Without it, SM cannot communicate with Apple devices.

Apple imposes the 365-day renewal, not Meraki.

Have a read of this article which describes the Apple Push Certificate requirement and steps in more detail - https://documentation.meraki.com/SM/Device_Enrollment/Apple_MDM_Push_Certificate

[SuRam]

I know the 365 day trial is imposed by Apple.

I'm just saying that instead of we getting the certificate, Meraki could get a single certificate which will be used to manage all the devices. We just select how to manage them. I'm sure Meraki would Renew the certificate before it expires. This would make the setup much more simpler, isn't it?

As they are not doing it, I would like to know if there is particular reason why we should get the .pem file.

Thank you.

[SuRam]

As a matter of fact, not only Meraki, none of the other MDM providers follow this. I would like to know why.

[jared_f]

This is an Apple limitation (as 99% of all MDM problems are). Also, it would be a security problem for some organizations, especially healthcare which I do, to have their MDM traffic over the same certificate. 

Meraki is is great at alerting you when that certificate is about to expire and has great guides to renew it. 

Hope thay answers the “why” aspect,

Jared

[SuRam]

So, you are saying that each one of us has to get the .pem file because of security concerns and handling our organizations traffic in our own file.

[jared_f]

I believe so. Why is the certificate such a big issue? It only takes 2 minutes to make/renew!

Also, I believe that this distinguishes MDM traffic between different servers.

[jared_f]

Certificates are free for anyone who has an Apple ID (also free). They used to (Apple) make you have a developer account for certificates.