Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Upgrade Workspace ONE (WS1) UEM Console before March 29, 2021 to support Apple Push Notifications over HTTP/2 (78976)

Last Updated: 7/19/2021Categories: InformationalTotal Views: 44142Language:
JapaneseEnglish

19 like this article

Subscribe to get an email
newsletter with new updates

19 people found this helpful Please provide article feedback:

Details

What Is Changing?

In December 2015, Apple made available its Apple Push Notifications Service (APNs) API using HTTP/2 requests instead of the legacy binary protocol interface for APNs. Since that time, Workspace ONE has been working on migrating our APNs messaging integration responsible for all Apple MDM commands and app notifications to the new API.

This has been a multi-year effort to ensure the success of our customers.

In the 2003 release, Workspace ONE UEM enabled the new HTTP/2 API for all MDM and app-related APNs messages by default for all upgraded environments.

This means that all MDM and app commands for enrollment, profiles, apps, samples, push notifications, etc., will communicate using this new API.

Starting in April 2021, Apple will stop supporting the legacy APNs communication interface.

Due to this, we encourage all Workspace ONE customers to upgrade their environments to an HTTP/2 supported version as soon as possible.

Review Apple's support article for more information: Updated APNs provider API deadline .

Apple Push Notification service server certificate update (On-Prem Only)

Per these changes, Apple has also announced HTTP/2 connections to the Apple Push Notification service must incorporate a new root certificate.

This change goes into effect on March 29th, 2021. As such, Workspace ONE application Console and Device Services servers must include the new root certificate (AAACertificateServices 5/12/2020 ) in the Trust Store of each of your notification servers before March 29.

An example script to accomplish this has been added to the "On-Premise" section of this article.

Review Apple’s support article for more information: Apple Push Notification service server certificate update

Note: For SaaS-hosted environments, this change will be handled by VMware internally, and no further action is required.

Solution

APNs API using HTTP/2 requests instead of the legacy binary protocol interface for APNs

On April 2021, Apple will stop supporting the legacy APN's communication interface. Due to this, we encourage all Workspace ONE customers to upgrade their environments to an HTTP/2 supported version as soon as possible.

Action Required:

Shared SaaS Customers – NONE

Dedicated SaaS Customers - We recommend upgrading to a supported version of Workspace ONE UEM. Here is the link (Workspace ONE UEM Console Release and End of General Support Matrix) where this issue is addressed.

On-Premise Customers - We recommend upgrading to a supported version of Workspace ONE UEM. Here is the link (Workspace ONE UEM Console Release and End of General Support Matrix) where this issue is addressed. Patches for supported releases are available. Please download and deploy the update.

Apple Push Notification service server certificate update (On-Prem Only)

As described above, on-premises customers must ensure the latest APNs server certificate must be added to the root store on Workspace ONE app servers.

Action Required:

For customers with SaaS-hosted of Workspace ONE UEM Console no further action is required. This change will be handled by VMware.

Customers with On-premises instances of Workspace ONE must deploy the new root certificate (AAACertificateServices 5/12/2020) on Workspace ONE application Console and Device Services servers. There are many ways to accomplish this result and the following serves as a basic example.

PowerShell.exe -Command Import-Certificate -FilePath "AAACertificateServices.crt" -CertStoreLocation Cert:\LocalMachine\Root

Proceed with the following steps:

Download updated root cert from here to your server and save as  "AAACertificateServices.crt".

Launch Powershell as Administrator.

Run script - PowerShell.exe -Command Import-Certificate -FilePath "{FolderPath}\AAACertificateServices.crt" -CertStoreLocation Cert:\LocalMachine\Root where {FolderPath} is the full path to the folder where the certificate is located

Related Information

Related Information for On-Premise Only

APNs API using HTTP/2 requests instead of the legacy binary protocol interface for APNs Socks proxy considerations

If using SOCKs proxy for legacy APNs over port 2195, no changes are required to support HTTP/2 post-upgrade to a supported version. It is recommended to leverage the Test Connection over the HTTP/2 button under the APNs settings page to confirm this will be successful.

HTTP proxy Considerations > Update to HTTP2

Legacy APNs traffic today is sent over port 2195 by default, while APNs HTTP/2 traffic is sent over port 443 by default. If you are using an HTTP proxy for all outbound 443 traffic, APNs over HTTP/2 may fail. It is recommended to update APNs over HTTP/2 communication to traffic over port 2197. To do this, follow the steps below:

Navigate to the AirWatch installation drive on your console server.

Edit the following keys in the config files, save the file, and restart the respective service:

Path

Key

Value

Service

/Websites/WanderingWiFi.AirWatch.Console.Web/Web.config

ProductionAPNSHttp2EndpointPort

2197

Restart IIS

/Services/AW.Send.Messaging.Service.exe.config

ProductionAPNSHttp2EndpointPort

2197

Restart AirWatch Messaging Service

Services/AW.Service.Scheduler.Service.exe.config

ProductionAPNSHttp2EndpointPort

2197

Restart AirWatch Device Scheduler service

Websites/AirwatchApi/Mdm/Web.config

ProductionAPNSHttp2EndpointPort

2197

Restart IIS

Repeat all steps on all Console and Device Services servers.

Test HTTP/2 Connection

Performing this test required Workspace ONE UEM version 1907 and later.

To ensure your existing devices will communicate successfully over HTTP/2 when this protocol is enabled, it is recommended to test the communication from your Workspace ONE UEM environment prior to fully enabling.

To perform the test, VMware has added a Test Connection button specifically to simulate an HTTP/2 request to APNs and provide feedback on your environment’s preparedness. This is available even with legacy APNs enabled by default for your enrolled devices.

Testing the connection over HTTP/2 will have no impact on existing devices or APN's communication.

For more information, see Check APNs Connectivity over HTTP/2.

Note: Testing connection for HTTP/2 will use your existing APNs certificate to make the request. Test HTTP/2 Connection feature in 20.01 tests on port 443 by default.

Source
Component

Destination
Component

Protocol

Port

Notes

UEM Console
Hostname

api.push.apple.com

HTTPS

443

Apple iOS, tvOS, and macOS Only

API Server
Hostname

api.push.apple.com

HTTPS

443

Apple iOS, tvOS, and macOS Only

Device Services
Hostname

api.push.apple.com

HTTPS

443

Apple iOS, tvOS, and macOS Only

Once these requirements are confirmed and Workspace ONE UEM has been upgraded, there should have no impact on existing or newly enrolling devices once enabled.

Test HTTP/2 Connection - Failed

If the aforementioned upgrades and/or patches have all been applied correctly and the "test HTTP/2 Connection" is failing, please ensure the ciphers for your environment are valid.

To do so, see HTTP/2 APNs Support For WS1 Windows Servers - Cipher Suites.

For more information on Workspace ONE UEM supported versions, please refer to this link: Workspace ONE UEM Console Release and End of General Support Matrix

Disclaimer: VMware is not responsible for the reliability of any data, opinions, advice, or statements made on third-party websites. The inclusion of such links does not imply that VMware endorses, recommends, or accepts any responsibility for the content of such sites.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
JapaneseEnglish

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

Result 1 of 1

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware Workspace ONE

Related Versions:

Take Our Survey

Support Assistant