title: Apple MDM Push Notification: Which key and certificate to use?
body: <p>I've been at this for about 12 hours.  All of the google links are purple that have anything to do with MDM.  I swear to all that matters that I've tried everything.  I've regenerated the Vendor and Customer CSRs, keys, etc a dozen times and cannot get a push notification to work.</p>
  
  <p>Here's what I've done:</p>
  
  <ol>
  <li>Created a vendor CSR, exported the private key as vendor.p12</li>
  <li>Logged into Apple Provisioning Portal and generated the MDM CSR Certificate</li>
  <li>Downloaded that certificate and called it vendor.cer</li>
  <li>Run this command "openssl pkcs12 -in vendor.p12 -nocerts -out vendor.pem"</li>
  <li>I then created a second CSR in Keychain Utility called customer.csr</li>
  <li>I used the cool python script found here: <a href="https://github.com/grinich/mdmvendorsign" rel="nofollow">https://github.com/grinich/mdmvendorsign</a></li>
  <li>I ran the command for this script: "python mdm_vendor_sign.py  --csr customer.csr --key vendor.key --mdm vendor.cer"</li>
  <li>This generated a plist cert request that I then uploaded to <a href="https://identity.apple.com/pushcert/" rel="nofollow">https://identity.apple.com/pushcert/</a></li>
  <li>I downloaded the certificate and called it client-push.pem</li>
  <li>I attempted to check and see if it works by running this command:
  "openssl s_client -connect gateway.sandbox.push.apple.com:2195 -cert push.pem -key vendor.pem".  This gives me the error "error setting private key
  67028:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:/SourceCache/OpenSSL098/OpenSSL098-47.1/src/crypto/x509/x509_cmp.c:406:"</li>
  </ol>
  
  <hr>
  
  <p>So my question is: what key and certificate combination do I use to send push notifications?  It makes sense that I would use the VENDOR key and the CUSTOMER's cert since I'm never going to have the CUSTOMER's private key, but is this wrong?  </p>
  
  <p>When I use the customer's KEY and CERT it looks like it works by printing a whole bunch of stuff but at the very top it says "verify error:num=20:unable to get local issuer certificate".  Besides, how will I get the customer's private key?</p>
  
  <p>The last thing to try was the vendor's cert and key, which seemed to work the exact same as using the customer's key and cert.</p>
  
  <p>Which combination is the correct way?</p>
  
  <p>On a side note, do I need to do anything to convert the "data" push token to a regular push token?  It says it's base64 encoded.  Do I need to decode it?</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>I've read that the token is a 32 byte base64 encoded string.  I'm using PHP to send the push notification os I figure a bin2hext(base64_decode(Token)) will work.  It looks legitimate when I do that at least.  Sill no push notification.</p>
  
  <p>I've also tried all possible combinations and the only time I can get it to send the notification without any errors i when I use both the vendor Key and Cert in the same PEM file.  The message still never arrives.  I've also tried (and successfully generated) the PEM cert file from identity.apple.com/pushcert quite a few times.  It says it worked on that page.  </p>
  
  <p>I'm using the Push library for the Laravel framework.  All it asks for is a certificate file, the push server host, and a pem password.  </p>
  
  <p>I'm getting this error when I try to use the pem file generated from identity.apple.com/pushcert:</p>
  
  <p>stream_socket_client(): Unable to set local cert chain file `/Users/neb/Dev/www/cgmdm/trunk/app/certificates/MDM.p12'; Check that your cafile/capath settings include details of your certificate and its issuer</p>