Why are APS certs required when using auth key/JWT?

Hi,


We've been using APNS via auth key/JWT authentication successfully for some time. My understanding is that this should allow us to send push notifications to any app linked to our team.


I'm trying to enable Push Notifications for a new App ID and to do so, I'm required to create an SSL cert (dev or prod) for the App ID.


Why is this required?


Thanks...

Replies

> My understanding is that this should allow us to send push notifications to any app linked to our team.


As far as I know, that's correct.


> I'm required to create an SSL cert (dev or prod) for the App ID.


Can you clarify? What's requiring you to do that?

APNS Auth Key and CERT based for push are both (currently) valid way for sending push notification.

The APNS Auth Key is the proper way to send pushes since it's more modern and use HTTP2 instead of the old CERT approach which require a persistent connection to Apple Push Server.

You probably did miss the option for generating APNS Auth Key... The other advantage of APNS Auth Key is the key don't expire so you don't have to worry about renewing before expiration... unlike the CERT approach which automatically expire after 1 year of being generated.

"There are two methods for communicating with the APNs servers.


(1) provider certificates

(2) provider authentication tokens


The doc referenced at

https://developer.apple.com/library/content/documentation/NetworkingInternet/Conceptual/RemoteNotificationsPG/CommunicatingwithAPNs.html#//apple_ref/doc/uid/TP40008194-CH11-SW1

sometimes does not clearly separate the two.


In your case, you are using method 2, provider authentication tokens. You do not need the provider certificates. Your statement that the SSL certificate is required for each apple bundle id is mentioned in "Creating a Universal Push Notification Client SSL Certificate". But, that is for method (1) provider certificates.


What you will need to do, if you want to send push notifications to multiple apps, is tell the APNs which app you are requesting push notifications for. You do this by configuring the 'apns-topic' header field in your HTTP request. See Table 8-2 APNs request headers. In the apns-topic section, you will see the following,


"If you are using a provider token instead of a certificate, you must specify a value for this request header. The topic you provide should be provisioned for the your team named in your developer account."


This requirement is not mentioned in the WWDC 2016 What's New in the Apple Push Notification Server https://developer.apple.com/videos/play/wwdc2016/724/

The apns-topic is your app-bundle-id found in XCode => Target => General tab => Bundle identifier.


Since you are already using the APNs successfully, you only need to modify the apns-topic in the HTTP requests going out for the new app.

Sorry for reviving an old topic, but I feel it is still relevant.

If I have a Key setup in my Developer portal at https://developer.apple.com/account/resources/authkeys/list, does this mean I do not need to configure Push Notifications against the app itself under Identifiers (https://developer.apple.com/account/resources/identifiers/list)? When I open an app identifier and tick Push Notifications, the configuration page asks for two certificates, Sandbox and Production. Do I just tick the box for Push notifications, but not "Configure" it?