APNS service can not be configured

[fishizza1]

We are running  on-premise CUCM 12.0.1.2290011 and trying to enable APNS for jabber clients.  Following the instructions here:  https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/push_notifications/cucm_b_push-notifications-deployment-guide/cucm_b_push-notifications-deployment-guide_chapter_01.html

After successfully generating the voucher we are then unable to Enable Push Notifications.  It fails with the error "Settings cannot be configured as a valid certificate is not present in trust store. Either upload the certificates manually or check the check box to have Cisco manage the Cisco Cloud Service CA Certificates. For HTTPS proxy make sure the valid certificates are present for tomcat and tomcat trust store."

We tried checking the box for "I want Cisco to manage the Cisco Cloud Service CA Certificates required for this trust" which didn't work.  We then tried to manually import the 3 certificates necessary per https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/push_notifications/cucm_b_push-notifications-deployment-guide/cucm_b_push-notifications-deployment-guide_chapter_011.html

Verified all three were there.  Did the tomcat restart and are still unsuccessful.  It still complains that a valid cert is not present in the trust store even though I can clearly see the 3 of them in there.  Not sure what else to check.  Any help is appreciated, thanks.

[Stephanie Knoop]

We had this problem in Oct. 2021.  TAC advised to upload the 3 certificates manually, restart the tomcat-trust and APNS service, then perform the steps to allow Cisco to manage the Cisco Cloud Service CA Certificates.  Apparently the initial certs are needed in order for the APNS service to create an initial connection and then begin to manage the certs.

[fishizza1]

Thanks.  We tried that but are still receiving the same error.  Sounds like a call into TAC is in our future.

[fishizza1 · Accepted solution]

After speaking with TAC our current build is not supported for push notifications.  Builds at 11.5.x and 12.5.x are so we are apparently in no-mans land and would need to upgrade or downgrade(?!) for this.

[Roger Kallberg]

The recommendation would clearly be to upgrade to 12.5. The current latest version is SU5, ie 12.5.15900.

[fishizza1]

Right, we certainly wouldn't downgrade.  Just seems odd to me that an older version supports a feature that our build does not

[Roger Kallberg]

It is because the .5 releases has got an update for a change in how APNS works when Apple did changes to their service. If I remember correctly that change was made about a year ago.

[Stephanie Knoop]

This is due to how Cisco manages the release cycle.  An SU to an older version will include some of the functionality that may not have made it in the .0 release of the newer version.

[Roger Kallberg]

For detailed information on this please see this field notice. https://www.cisco.com/c/en/us/support/docs/field-notices/705/fn70555.html

[fishizza1]

Thanks everyone!