title: Getting “EndpointDisabled” from Amazon SNS (APNS Production)
body: <p>I have been successfully testing sending push notifications to Apple devices using SNS, currently in Xcode with the APNS_SANDBOX.</p>
  
  <p>We are now ready to move to production and are having an absolute nightmare getting the certificates set up properly on the APNS (Production) application endpoint. </p>
  
  <p>I am following the same process we followed during development and have consulted several guides.</p>
  
  <p>Each time we try to send a push notification to a device we get the following failure notification:</p>
  
  <p><code>{"DeliveryAttempts":1,"EndpointArn":"arn:aws:sns:eu-west-1:123456789:endpoint/APNS/Name/e591d1a1-8db3-3382-8091-ab1a3cb3cac5","EventType":"DeliveryFailure","FailureMessage":"Endpoint is disabled","FailureType":"EndpointDisabled","MessageId":"08a70f95-773c-58fb-a6f9-5df1650eeb19","Resource":"arn:aws:sns:eu-west-1:123456789:app/APNS/Name","Service":"SNS","Time":"2017-10-20T15:02:10.824Z"}
  </code></p>
  
  <p>I understand this can relate to several issues but is likely a problem with the certificate uploaded to SNS.</p>
  
  <p>The process we have followed:</p>
  
  <ol>
  <li><p>From Apple Developer website visit navigate to <strong>Certificates, IDs &amp; Profiles</strong> > Identifiers > App IDs</p></li>
  <li><p>Create a new App ID and enable the Push Notifications service.</p></li>
  <li><p>Click Create a new Production SSL certificate, then create a new CSR file in the local keychain on Mac, upload it to Developer site (during the certificate generation process) then download the generated <code>.cer</code> file.</p></li>
  <li><p>Double click the <code>.cer</code> file to add it to the Keychain on mac.</p></li>
  <li><p>At this point we have consulted <a href="http://docs.aws.amazon.com/sns/latest/dg/mobile-push-apns.html" rel="nofollow noreferrer">http://docs.aws.amazon.com/sns/latest/dg/mobile-push-apns.html</a> documentation which suggests running the following command:</p></li>
  </ol>
  
  <p><code>openssl x509 -in myapnsappcert.cer -inform DER -out myapnsappcert.pem</code></p>
  
  <ol start="6">
  <li><p>Back inside Keychain select Keys, highlight the apps private key and export it the <code>.p12</code> file.</p></li>
  <li><p>Back in the command prompt run the following command as per the AWS docs: <code>openssl pkcs12 -in myapnsappprivatekey.p12 -out myapnsappprivatekey.pem -nodes -clcerts</code> to generate another <code>.pem</code> file.</p></li>
  </ol>
  
  <p>Amazon goes on to say:</p>
  
  <p><em>The newly created .pem file will be used to configure Amazon SNS for sending mobile push notification messages.</em></p>
  
  <p><strong>This leads me to believe the docs are outdated as uploading the <code>.pem</code> file to the SNS APNS Applications credentials manager returns an error stating that it cannot read the file.</strong></p>
  
  <p>According to the SNS credentials manager for the APNS Application, it only accepts the <code>.p12</code> file... if that is the case, why the need to create the final <code>.pem</code> file? This step still required? Have I missed a step?</p>
  
  <p>I uploaded the final .p12 file anyway, but obviously, it does not work.</p>
  
  <p>I appreciate there are other questions similar to this but the answers are so broad that there are no real solutions other than trial and error. I believe my issue is specifically related to incorrectly generated certificates, or a step is missing out of the process.</p>
  
  <p>I guess I am reaching out to anybody who has done this recently who can clarify the steps involved.</p>
  
  <p>Thanks</p>