Google Workspace and APNS Certificates: Complete Guide to Mobile Device Management and Push Notifications

# Check certificate expiration date
openssl x509 -in MDM_Certificate.pem -noout -dates

# View certificate details
openssl x509 -in MDM_Certificate.pem -noout -text

# Verify certificate subject
openssl x509 -in MDM_Certificate.pem -noout -subject

# Test APNS connectivity
curl -v https://api.push.apple.com

# Check certificate on enrolled device (iOS)
# Settings > General > VPN & Device Management > Management Profile

# Verify in Google Admin Console
# Devices > Mobile & endpoints > Settings > iOS
# Confirm new expiration date is displayed

# Verify certificate is valid and not expired
openssl x509 -in certificate.pem -noout -dates

# Check certificate format
file certificate.pem
# Should show: PEM certificate

# Required APNS endpoints (must be accessible)
17.0.0.0/8 (Apple's IP range)
443/tcp (HTTPS)
2197/tcp (APNS)
5223/tcp (APNS)

# Test connectivity
nc -zv gateway.push.apple.com 2197
# Should show: succeeded!

# APNS uses these Apple IP ranges
17.0.0.0/8
tcp/443, tcp/5223, tcp/2195-2197

# Test from device network
ping -c 5 17.188.128.0
telnet gateway.push.apple.com 5223

# Check MDM enrollment status
sudo profiles show -type enrollment

# View installed profiles
sudo profiles list

# Check APNS connectivity
nc -zv gateway.push.apple.com 2197

# Force MDM check-in
sudo profiles renew -type enrollment

# View profile details
sudo profiles show

# Check system logs for MDM errors
log show --predicate 'subsystem == "com.apple.ManagedClient"' --last 1h

# Configure iOS/macOS to use proxy
# Settings > Wi-Fi > (network) > Configure Proxy

# Proxy must support HTTPS CONNECT method
# APNS requires direct connection (cannot intercept SSL)

# Verify proxy allows Apple domains
- *.push.apple.com
- *.apple.com

# From macOS or Linux
nc -zv gateway.push.apple.com 2197
nc -zv gateway.push.apple.com 5223

# From Windows (PowerShell)
Test-NetConnection -ComputerName gateway.push.apple.com -Port 2197

# Check DNS resolution
nslookup gateway.push.apple.com

# Test SSL connectivity
openssl s_client -connect gateway.push.apple.com:2197

# Sysdiagnose for advanced troubleshooting
# On device: Settings > Privacy > Analytics & Improvements > Analytics Data
# Or generate new:
# Hold Volume Up + Volume Down + Power for 2 seconds

# Real-time MDM logs
log stream --predicate 'subsystem == "com.apple.ManagedClient"'

# Last hour of MDM activity
log show --predicate 'subsystem == "com.apple.ManagedClient"' --last 1h --style compact

# Profile installation logs
log show --predicate 'processImagePath CONTAINS "mdmclient"' --last 1h

# Export logs for analysis
sudo sysdiagnose -f ~/Desktop/

#!/usr/bin/env python3
"""
Monitor Google Workspace APNS certificate expiration and send alerts.
Requires: google-auth, google-auth-oauthlib, google-auth-httplib2, google-api-python-client
"""

import datetime
import os
import smtplib
from email.mime.text import MIMEText
from google.oauth2 import service_account
from googleapiclient.discovery import build

# Configuration from environment variables
SERVICE_ACCOUNT_FILE = os.environ.get('SERVICE_ACCOUNT_FILE', '/path/to/service-account-key.json')
ADMIN_EMAIL = os.environ.get('ADMIN_EMAIL', 'admin@example.com')
SMTP_SERVER = os.environ.get('SMTP_SERVER', 'smtp.gmail.com')
SMTP_PORT = int(os.environ.get('SMTP_PORT', '587'))
ALERT_THRESHOLDS = [90, 60, 30, 14, 7, 3, 1]  # Days before expiration

# Google Workspace API scopes
SCOPES = ['https://www.googleapis.com/auth/admin.directory.device.mobile.readonly']

def get_apns_certificate_info():
    """Retrieve APNS certificate information from Google Workspace."""
    credentials = service_account.Credentials.from_service_account_file(
        SERVICE_ACCOUNT_FILE, scopes=SCOPES)
    
    # Delegate credentials to admin user
    delegated_credentials = credentials.with_subject(ADMIN_EMAIL)
    
    # Note: This is conceptual - actual API endpoint varies
    # Google Admin SDK doesn't expose APNS cert details directly
    # Alternative: Parse from Admin Console or use Admin SDK alerts
    
    service = build('admin', 'directory_v1', credentials=delegated_credentials)
    
    # In practice, you might need to:
    # 1. Scrape Admin Console (not recommended)
    # 2. Parse stored certificate file
    # 3. Use Google Cloud Monitoring/Logging
    
    # Example return with relative date (1 year from now)
    expiration_date = datetime.datetime.now() + datetime.timedelta(days=365)
    return {
        'expiration_date': expiration_date,
        'certificate_status': 'Active',
        'days_remaining': (expiration_date - datetime.datetime.now()).days
    }

def check_certificate_file(cert_file_path):
    """Check APNS certificate expiration from local PEM file."""
    import subprocess
    
    # Extract expiration date from certificate
    result = subprocess.run(
        ['openssl', 'x509', '-in', cert_file_path, '-noout', '-enddate'],
        capture_output=True, text=True, check=True
    )
    
    # Parse output: notAfter=Jan 26 21:22:00 2025 GMT
    # Note: Strip timezone suffix for reliable parsing
    date_str = result.stdout.split('=')[1].strip()
    # Remove 'GMT' or other timezone abbreviations
    date_str_no_tz = ' '.join(date_str.split()[:-1])
    expiration_date = datetime.datetime.strptime(date_str_no_tz, '%b %d %H:%M:%S %Y')
    
    days_remaining = (expiration_date - datetime.datetime.now()).days
    
    return {
        'expiration_date': expiration_date,
        'days_remaining': days_remaining
    }

def send_alert(days_remaining, expiration_date):
    """Send email alert for certificate expiration."""
    subject = f"⚠️ APNS Certificate Expiring in {days_remaining} Days"
    
    body = f"""
APNS Certificate Expiration Alert

Certificate will expire on: {expiration_date.strftime('%Y-%m-%d')}
Days remaining: {days_remaining}

ACTION REQUIRED:
1. Sign in to Apple Push Certificates Portal (identity.apple.com/pushcert)
2. Renew certificate using Apple ID: mdm@example.com
3. Upload renewed certificate to Google Admin Console

Documentation: https://support.google.com/a/answer/6328701

This is an automated alert. Do not reply to this email.
    """
    
    msg = MIMEText(body)
    msg['Subject'] = subject
    msg['From'] = ADMIN_EMAIL
    msg['To'] = ADMIN_EMAIL
    
    # Get credentials from environment variable
    smtp_password = os.environ.get('SMTP_PASSWORD')
    
    with smtplib.SMTP(SMTP_SERVER, SMTP_PORT) as server:
        server.starttls()
        server.login(ADMIN_EMAIL, smtp_password)
        server.send_message(msg)

def main():
    """Main monitoring function."""
    # Option 1: Check from certificate file
    cert_info = check_certificate_file('/path/to/MDM_Certificate.pem')
    
    # Option 2: Retrieve from Google Workspace (if API available)
    # cert_info = get_apns_certificate_info()
    
    days_remaining = cert_info['days_remaining']
    
    # Send alerts at configured thresholds
    if days_remaining in ALERT_THRESHOLDS:
        send_alert(days_remaining, cert_info['expiration_date'])
        print(f"Alert sent: {days_remaining} days remaining")
    else:
        print(f"No alert needed: {days_remaining} days remaining")

if __name__ == '__main__':
    main()

# Add to crontab (crontab -e)
# Run daily at 9 AM
0 9 * * * /usr/bin/python3 /path/to/apns_monitor.py >> /var/log/apns_monitor.log 2>&1

# Alternative: Use systemd timer
# /etc/systemd/system/apns-monitor.service
[Unit]
Description=APNS Certificate Monitoring
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/bin/python3 /path/to/apns_monitor.py
User=apns-monitor
Group=apns-monitor

# /etc/systemd/system/apns-monitor.timer
[Unit]
Description=APNS Certificate Monitoring Timer
Requires=apns-monitor.service

[Timer]
OnCalendar=daily
Persistent=true

[Install]
WantedBy=timers.target

# Enable timer
sudo systemctl enable apns-monitor.timer
sudo systemctl start apns-monitor.timer

#!/bin/bash
# apns_renewal_workflow.sh
# Guides administrator through renewal process

set -e

CERT_FILE="/path/to/MDM_Certificate.pem"
APPLE_ID="mdm@example.com"
ADMIN_CONSOLE_URL="https://admin.google.com/ac/devices/mobile/settings/ios"
APPLE_PORTAL_URL="https://identity.apple.com/pushcert"

echo "=== APNS Certificate Renewal Workflow ==="
echo ""

# Check current certificate expiration
echo "Checking current certificate..."
EXPIRY_DATE=$(openssl x509 -in "$CERT_FILE" -noout -enddate | cut -d= -f2)
echo "Current certificate expires: $EXPIRY_DATE"
echo ""

# Calculate days remaining
EXPIRY_EPOCH=$(date -d "$EXPIRY_DATE" +%s)
CURRENT_EPOCH=$(date +%s)
DAYS_REMAINING=$(( ($EXPIRY_EPOCH - $CURRENT_EPOCH) / 86400 ))

echo "Days remaining: $DAYS_REMAINING"
echo ""

if [ $DAYS_REMAINING -gt 30 ]; then
    echo "Certificate renewal not yet required (30+ days remaining)"
    exit 0
fi

echo "⚠️  Certificate renewal recommended!"
echo ""

# Step 1: Download CSR from Google Workspace
echo "STEP 1: Download Certificate Signing Request (CSR)"
echo "------------------------------------------------------"
echo "1. Open: $ADMIN_CONSOLE_URL"
echo "2. Click 'Renew certificate'"
echo "3. Click 'Download certificate signing request'"
echo "4. Save as: Google_Workspace_CSR.csr"
echo ""
read -p "Press Enter when CSR is downloaded..."

# Step 2: Renew at Apple Portal
echo ""
echo "STEP 2: Renew Certificate at Apple Push Certificates Portal"
echo "------------------------------------------------------"
echo "1. Open: $APPLE_PORTAL_URL"
echo "2. Sign in with Apple ID: $APPLE_ID"
echo "3. Locate existing certificate (expires $EXPIRY_DATE)"
echo "4. Click 'Renew'"
echo "5. Upload Google_Workspace_CSR.csr"
echo "6. Download renewed certificate (save as: MDM_Certificate_NEW.pem)"
echo ""
read -p "Press Enter when new certificate is downloaded..."

# Step 3: Upload to Google Workspace
echo ""
echo "STEP 3: Upload Renewed Certificate to Google Workspace"
echo "------------------------------------------------------"
echo "1. Return to: $ADMIN_CONSOLE_URL"
echo "2. Click 'Upload renewed certificate'"
echo "3. Select: MDM_Certificate_NEW.pem"
echo "4. Click 'Save'"
echo "5. Verify new expiration date is displayed"
echo ""
read -p "Press Enter when certificate is uploaded..."

# Step 4: Verify renewal
echo ""
echo "STEP 4: Verify Certificate Renewal"
echo "------------------------------------------------------"
read -p "Enter path to new certificate file: " NEW_CERT_FILE

if [ ! -f "$NEW_CERT_FILE" ]; then
    echo "Error: Certificate file not found: $NEW_CERT_FILE"
    exit 1
fi

NEW_EXPIRY_DATE=$(openssl x509 -in "$NEW_CERT_FILE" -noout -enddate | cut -d= -f2)
echo "New certificate expires: $NEW_EXPIRY_DATE"

NEW_EXPIRY_EPOCH=$(date -d "$NEW_EXPIRY_DATE" +%s)
NEW_DAYS_REMAINING=$(( ($NEW_EXPIRY_EPOCH - $CURRENT_EPOCH) / 86400 ))

if [ $NEW_DAYS_REMAINING -gt 360 ]; then
    echo "✅ Certificate renewal successful!"
    echo "   New expiration: $NEW_EXPIRY_DATE"
    echo "   Days until expiration: $NEW_DAYS_REMAINING"
    
    # Backup old certificate
    BACKUP_FILE="${CERT_FILE}.backup.$(date +%Y%m%d)"
    cp "$CERT_FILE" "$BACKUP_FILE"
    echo "   Old certificate backed up to: $BACKUP_FILE"
    
    # Update certificate file
    cp "$NEW_CERT_FILE" "$CERT_FILE"
    echo "   Certificate file updated: $CERT_FILE"
else
    echo "⚠️  Warning: New certificate expiration seems incorrect"
    echo "   Please verify renewal was successful"
fi

echo ""
echo "=== Renewal workflow complete ==="

#!/usr/bin/env python3
"""
Send APNS certificate expiration alerts to Slack.
"""

import requests
import datetime
import subprocess

SLACK_WEBHOOK_URL = 'https://hooks.slack.com/services/YOUR/WEBHOOK/URL'
CERT_FILE = '/path/to/MDM_Certificate.pem'

def get_cert_expiration():
    """Get certificate expiration date."""
    result = subprocess.run(
        ['openssl', 'x509', '-in', CERT_FILE, '-noout', '-enddate'],
        capture_output=True, text=True, check=True
    )
    date_str = result.stdout.split('=')[1].strip()
    # Remove timezone suffix for reliable parsing
    date_str_no_tz = ' '.join(date_str.split()[:-1])
    expiration_date = datetime.datetime.strptime(date_str_no_tz, '%b %d %H:%M:%S %Y')
    days_remaining = (expiration_date - datetime.datetime.now()).days
    return expiration_date, days_remaining

def send_slack_alert(days_remaining, expiration_date):
    """Send Slack notification."""
    
    # Color coding based on urgency
    if days_remaining <= 7:
        color = 'danger'
        emoji = '🚨'
    elif days_remaining <= 30:
        color = 'warning'
        emoji = '⚠️'
    else:
        color = 'good'
        emoji = 'ℹ️'
    
    message = {
        'attachments': [{
            'color': color,
            'title': f'{emoji} APNS Certificate Expiring in {days_remaining} Days',
            'text': f'The Google Workspace APNS certificate will expire on *{expiration_date.strftime("%Y-%m-%d")}*.',
            'fields': [
                {
                    'title': 'Days Remaining',
                    'value': str(days_remaining),
                    'short': True
                },
                {
                    'title': 'Expiration Date',
                    'value': expiration_date.strftime('%Y-%m-%d'),
                    'short': True
                }
            ],
            'actions': [
                {
                    'type': 'button',
                    'text': 'Renew at Apple Portal',
                    'url': 'https://identity.apple.com/pushcert'
                },
                {
                    'type': 'button',
                    'text': 'Google Admin Console',
                    'url': 'https://admin.google.com/ac/devices/mobile/settings/ios'
                }
            ],
            'footer': 'APNS Certificate Monitor',
            'ts': int(datetime.datetime.now().timestamp())
        }]
    }
    
    response = requests.post(SLACK_WEBHOOK_URL, json=message)
    
    if response.status_code == 200:
        print(f"Slack alert sent successfully")
    else:
        print(f"Failed to send Slack alert: {response.status_code} {response.text}")

def main():
    expiration_date, days_remaining = get_cert_expiration()
    
    # Send alerts at specific thresholds
    alert_thresholds = [90, 60, 30, 14, 7, 3, 1]
    
    if days_remaining in alert_thresholds:
        send_slack_alert(days_remaining, expiration_date)

if __name__ == '__main__':
    main()

# main.py - Google Cloud Function
"""
Google Cloud Function to monitor APNS certificate expiration.
Triggered daily via Cloud Scheduler.
"""

import base64
import datetime
import subprocess
import os
from google.cloud import storage
from sendgrid import SendGridAPIClient
from sendgrid.helpers.mail import Mail

def check_apns_certificate(event, context):
    """
    Cloud Function triggered by Cloud Scheduler.
    Checks APNS certificate expiration and sends alerts.
    """
    
    # Configuration from environment variables
    bucket_name = os.environ.get('CERT_BUCKET_NAME')
    cert_file_name = os.environ.get('CERT_FILE_NAME', 'MDM_Certificate.pem')
    alert_email = os.environ.get('ALERT_EMAIL')
    sendgrid_api_key = os.environ.get('SENDGRID_API_KEY')
    
    # Download certificate from Cloud Storage
    storage_client = storage.Client()
    bucket = storage_client.bucket(bucket_name)
    blob = bucket.blob(cert_file_name)
    
    cert_content = blob.download_as_text()
    
    # Write to temporary file
    temp_cert_path = f'/tmp/{cert_file_name}'
    with open(temp_cert_path, 'w') as f:
        f.write(cert_content)
    
    # Extract expiration date
    result = subprocess.run(
        ['openssl', 'x509', '-in', temp_cert_path, '-noout', '-enddate'],
        capture_output=True, text=True
    )
    
    date_str = result.stdout.split('=')[1].strip()
    # Remove timezone suffix for reliable parsing
    date_str_no_tz = ' '.join(date_str.split()[:-1])
    expiration_date = datetime.datetime.strptime(date_str_no_tz, '%b %d %H:%M:%S %Y')
    days_remaining = (expiration_date - datetime.datetime.now()).days
    
    print(f"Certificate expires: {expiration_date}")
    print(f"Days remaining: {days_remaining}")
    
    # Send alert at thresholds
    alert_thresholds = [90, 60, 30, 14, 7, 3, 1]
    
    if days_remaining in alert_thresholds:
        send_alert_email(
            alert_email, 
            sendgrid_api_key, 
            days_remaining, 
            expiration_date
        )
        print(f"Alert email sent for {days_remaining} days remaining")
    
    # Clean up
    os.remove(temp_cert_path)
    
    return {'status': 'success', 'days_remaining': days_remaining}

def send_alert_email(to_email, api_key, days_remaining, expiration_date):
    """Send alert email via SendGrid."""
    
    urgency = '🚨 URGENT' if days_remaining <= 7 else '⚠️ WARNING'
    
    message = Mail(
        from_email='noreply@example.com',
        to_emails=to_email,
        subject=f'{urgency}: APNS Certificate Expiring in {days_remaining} Days',
        html_content=f"""
        <h2>APNS Certificate Expiration Alert</h2>
        <p><strong>Days Remaining:</strong> {days_remaining}</p>
        <p><strong>Expiration Date:</strong> {expiration_date.strftime('%Y-%m-%d')}</p>
        
        <h3>Action Required:</h3>
        <ol>
            <li><a href="https://admin.google.com/ac/devices/mobile/settings/ios">Download CSR from Google Admin Console</a></li>
            <li><a href="https://identity.apple.com/pushcert">Renew certificate at Apple Push Certificates Portal</a></li>
            <li>Upload renewed certificate to Google Admin Console</li>
        </ol>
        
        <p><em>This is an automated alert from APNS Certificate Monitor.</em></p>
        """
    )
    
    sg = SendGridAPIClient(api_key)
    response = sg.send(message)
    
    return response.status_code

# requirements.txt
# google-cloud-storage==2.10.0
# sendgrid==6.10.0

# Deploy Cloud Function
gcloud functions deploy apns-cert-monitor \
    --runtime python310 \
    --trigger-topic apns-cert-check \
    --entry-point check_apns_certificate \
    --set-env-vars CERT_BUCKET_NAME=my-certs-bucket,ALERT_EMAIL=admin@example.com \
    --set-secrets SENDGRID_API_KEY=sendgrid-key:latest

# Create Cloud Scheduler job (daily at 9 AM)
gcloud scheduler jobs create pubsub apns-cert-check-daily \
    --schedule="0 9 * * *" \
    --topic=apns-cert-check \
    --message-body="check" \
    --time-zone="America/New_York"