Cannot upload Apple Push Certificate

Question

I'm trying to configure a connected app to send push notifications, following the instructions in Salesforce Mobile Push Notifications Implementation Guide.

From the docs:

In the iOS Developer Member Center, create an ID for your app, then use the CSR file to generate a certificate. Next, use OpenSSL to combine this certificate with the private key file to create an appkey.p12 file. You’ll need this file later to configure your connected app.

There are no instructions on using OpenSSL, only a reference to this tutorial which is not Salesforce specific. I've tried to follow the directions in that tutorial, but when I try to upload the cert file, I get the error "The Apple push certificate or password is invalid."

First off, the quote above says you must combine the certificate from apple (aps_development.cer) with your private key file to create a .p12 file. There are a couple of things wrong here:

1. When you export your private key, that generates a .p12 file.
2. The instructions in the linked tutorial have you use openssl to convert the .p12 file to a .pem file, and to convert your certificate to a .pem file. You then concatenate the two files into a single .pem file.

I assume this is what the salesforce docs mean by, "use OpenSSL to combine this certificate with the private key file, " however, it says that you'll create a .p12file. I'm guessing this is in error?

The tutorial includes instructions for connecting to Apple's sandbox push server using your cert & key .pem files, and this worked for me, so at a minimum I know I've got good .pem files. I just can't upload the cert to salesforce. I've tried uploading each of the following:

1. original exported private key .p12 file
2. original aps_development.cer file from apple
3. converted private key .pem file
4. converted certificate .pem file
5. concatenated .pem file

Salesforce will not accept any of these. Finally - several of these steps involve the use of a passphrase. I generated a passphrase at the beginning of the process, pasted it into an editor, and copy-pasted it at each step to ensure I didn't have passphrase issues. This is the same way I'm filling in the 'certificate password' field in Salesforce, so I feel pretty certain that this isn't a password problem.

Has anyone gotten this to work, using Apple APNS with a Development certificate?

Answer 1

I got this to work by ignoring the tutorial I linked above. The Salesforce docs also include a link to the Apple Developer Center, but it's a generic link to the Mac Dev Center landing page. I found good directions to follow in the "Configuring Push Notifications" section of the App Distribution Guide in the iOS Dev center.

The key difference is what you do once you have the APNS Certificate and keys created and imported into Keychain Access. Open Keychain Access, and select the "My Certificates" view in the left nav bar (this doesn't appear to work correctly if you select "All items"). You should see your APNS cert, e.g., "Apple Development iOS Push Services: <<bundle identifier>>", and it should have a disclosure triangle next to it. Click the triangle and your private key will appear. Select both the cert and the private key, and select File|Export.... Choose the .p12 file format and specify a password to protect your exported key. This will create a single .p12 file (Certificates.p12) is the default name. Upload this file to Salesforce and provide your password.

Also - pasting my password didn't seem to work, I had to type it into the salesforce UI.