Apple Push Notification service server certificate update

Question

On March 29, 2021, token and certificate-based HTTP/2 connections to the Apple Push Notification service must incorporate the new root certificate (AAACertificateServices 5/12/2020) which replaces the old GeoTrust Global CA root certificate. To ensure a seamless transition and to avoid push notification delivery failures, verify that both the old and new root certificates for the HTTP/2 interface are included in the Trust Store of each of your notification servers before March 29.

Note that Apple Push Notification service SSL provider certificates issued to you by Apple do not need be to updated at this time.

I got this email regarding the updation of push notification certificates. I have configured FCM (Firebase) to send push notifications, using APNs Authentication Key. I didn't generate any certificates yet for push notification.

Do I need to change anything on my end?

Freethinker

zealousweb.com/… – Mitzi

Answer 1

In your case, no. You are already using the new authentication mechanism and don't need to change the key:

Note that Apple Push Notification service SSL provider certificates issued to you by Apple do not need be to updated at this time.

You can trust Firebase/Google has updated the root certificate on their end. (If they didn't, they'll probably lose the trust of several thousands of customers.) They own the 'notification servers' mentioned in the email.

Bottle

@Glorfinedel im not get u... can u please share more info..... – Philemol

What if we are connecting to APNs manually using a server and not using Firebase ? – Inkberry

@AwaisFayyaz if your OS is up to date, you're fine. It will already contain the certificates necessary to trust the one Apple uses. – Bottle

by OS you mean the operating system of my backend server? – Inkberry

@AwaisFayyaz yes, the one that is doing the actual communication with Apple's APNS server (api.push.apple.com). – Bottle

my backend server's OS is Ubuntu 18.04.3 LTS? does it qualify as 'up to date'? – Inkberry

@AwaisFayyaz you could try the solution mentioned here: https://mcmap.net/q/591644/-an-example-of-a-domain-that-uses-aaacertificateservices-cert/4751173 – Bottle

Let us continue this discussion in chat. – Inkberry