Push notification certificate updates on servers

[biblicabeebli]

Still Researching

• Received this email last week from Apple
• googling is not working well for this one
• seems to be a server-side certificat trust store issue
• may need to update the FireBase version? for safety? how does that interact with trust stores
• we should probably update the firebase code anyway.

@reyvababtista I know you are busy, please scan updates on this thread.

Original Email

Hello,

We’re reaching out with a final reminder that the Certification Authority (CA) for Apple Push Notification service (APNs) is changing. APNs updated the server certificates in sandbox on January 21, 2025. APNs production server certificates will be updated on February 24, 2025. To continue using APNs without interruption, you’ll need to update your application’s Trust Store to include the new server certificate: SHA-2 Root: USERTrust RSA Certification Authority certificate.

To ensure a smooth transition and avoid push notification delivery failures, please make sure that both old and new server certificates are included in the Trust Store before the cut-off date for each of your application servers that connect to sandbox and production. At this time, you don’t need to update the APNs SSL provider certificates issued to you by Apple.

If you have any questions, please contact us.

The Apple Developer Relations Team

[biblicabeebli]

This website pretty unambiguously says this is handled by our backend, FireBase....

• https://www.theapplepost.com/2025/02/09/67954/apple-to-update-push-notification-service-with-new-server-certificate-this-month/

[biblicabeebli]

This is a one-liner to view the certs in the trust store on ubuntu 24.04...
awk -v cmd='openssl x509 -noout -subject' '/BEGIN/{close(cmd)};{print | cmd}' < /etc/ssl/certs/ca-certificates.crt

~directions from apple docs

• https://developer.apple.com/documentation/usernotifications/setting-up-a-remote-notification-server#Establish-a-trusted-connection-to-APNs
• which directly links to this page for the new cert: https://www.sectigo.com/knowledge-base/detail/Sectigo-Intermediate-Certificates/kA01N000000rfBO