iPhone Enrollment in ManageEngine MDM and APNs Certificate Expired Fix
All your iPhones suddenly show offline and commands stop working? Nine times out of ten it is one thing: the yearly APNs certificate expired. Here is the enrollment picture and the exact fix.
🎥 Full video — see the iOS setup and APNs configuration in the console
Apple does not let any MDM server talk to an iPhone directly. Every command — a profile push, a lock, a wipe — travels through Apple Push Notification service (APNs), and your server needs a certificate to use it. That certificate is valid for exactly one year. Miss the renewal date and every enrolled iPhone and iPad quietly stops being managed: no error on the devices themselves, just silence. This guide covers how iOS enrollment works in ManageEngine MDM Plus and the step-by-step APNs renewal that brings everything back — without re-enrolling a single device, if you renew the right way.
MDM Console — Enrollment → APNs Certificate
APNs Certificate StatusEXPIRED
iPhone and iPad managementStopped
Profiles, apps and commandsNot reaching devices
Renewal with the same Apple IDNO RE-ENROLLMENT
The classic symptom: Android devices work fine, every Apple device is frozen at its last sync — because only Apple traffic depends on the APNs certificate.
1
How iOS Enrollment Works in MDM Plus
Three routes, depending on ownership:
Apple Business Manager (ABM) — company iPhones bought from authorised sellers appear in ABM and enroll automatically during setup (zero-touch), as supervised devices with the deepest control
Apple Configurator — a Mac-based tool to prepare and supervise smaller numbers of company devices over USB
Invite / self-enrollment — the route for personal iPhones (BYOD): the user installs the management profile; control is limited to work apps and accounts
All three routes need a valid APNs certificate on the server first. Without it, enrollment itself fails.
2
Recognise the APNs Problem Before You Renew
Confirm the diagnosis in two minutes:
In the console, open Enrollment → APNs Certificate and check the expiry date shown
If the date has passed — or the console shows the APNS certificate Expired/Revoked message — you have found the fault
Also check your admin email: Apple and ManageEngine both send a warning about 30 days before expiry (the Renew button itself appears about a month early)
3
Renew the APNs Certificate — Exact Steps
Renewal means producing a fresh certificate from the same certificate identity. Follow this order:
In the MDM console go to Enrollment → APNs Certificate and click Renew APNs Certificate
Download the new vendor-signed CSR (Certificate Signing Request) file the console offers
Sign in to the Apple Push Certificates Portal with the same corporate Apple ID used to create the original certificate
Find your existing certificate in the portal and choose Renew — not Create a new certificate — then upload the CSR
Download the renewed certificate file (.pem) from Apple
Back in the MDM console, upload the renewed certificate and confirm the new expiry date (one year from now) is displayed
Test with one iPhone: send a simple command like a device scan from Inventory → Devices → Scan Now — it should respond within minutes
Done this way, all enrolled Apple devices reconnect on their own as they next contact the server. No user has to do anything.
4
The Two Mistakes That Force Full Re-Enrollment
Renewal goes wrong in exactly two ways — both avoidable:
Creating a brand-new certificate instead of renewing: a new identity means Apple treats it as a different server — every iOS device must be unenrolled and enrolled again
Using a different Apple ID (for example, the personal ID of whoever is on duty): same result — the certificate no longer matches, and devices must re-enroll
Rule for the office: keep one shared corporate Apple ID for APNs, note its credentials in the company password vault, and put the renewal date in the calendar a month early.
🔴 Already expired? Renewing an expired certificate with the same Apple ID and the Renew option still restores management without re-enrollment in the normal case — do that first before planning any mass re-enrollment. And never let anyone "fix" it by deleting the certificate from the console: removal de-provisions Apple management entirely until a new certificate is uploaded.
🎥 Watch the Complete MDM Setup in the Video
Every step shown live in the ManageEngine MDM console — enrollment, profiles, apps and security commands, in full detail.
One year from creation. The MDM console shows the expiry date under Enrollment → APNs Certificate, the Renew button appears about a month before expiry, and reminder emails go to the registered admin address roughly 30 days ahead.
Our APNs certificate expired last week. Do all iPhones need re-enrollment?
Usually not. Renew the certificate in the Apple Push Certificates Portal using the same corporate Apple ID and the Renew option, upload it to the console, and devices reconnect as they contact the server. Re-enrollment is only forced if a new certificate identity was created with a different Apple ID.
Why do Android devices keep working when APNs expires?
Android management does not use Apple's push service — Android devices communicate with the MDM server directly (and via Google's FCM). APNs only carries traffic to Apple devices, so an expired APNs certificate affects iPhones, iPads and Macs alone.
This guide is based on the ManageEngine MDM video by Technical Anshu • Stuck on a step? Ask in the video comments — that is where answers come fastest 🙏