Home

IOS Common Q&A:

How to update Certificate (AAACertificate / GeoTrust)

1. Locate your keystore location

java -XshowSettings:properties -version

The property java.home is the current default Java Home. And the cert file should be located in ${JAVA_HOME}/jre/lib/security/cacerts.
e.g. /Library/Java/JavaVirtualMachines/jdk1.8.0_201.jdk/Contents/Home/jre/lib/security/cacerts

If you have multiple Java versions installed on your system, please make sure the default Java is the one you want import certificate into.

2. Get cert file

We provide GeoTrust and AAA Certfile in push_service/src/main/resources/AAACertificateServices.crt and push_service/src/main/resources/GeoTrust_Global_CA.pem

openssl x509 -in <(openssl s_client -connect api.push.apple.com:443 -prexit 2>/dev/null) -out ~/AppleAAAPushCert.crt

The api.push.apple.com:443 is the Apns Server address.
The ~/AppleAAAPushCert.crt is the location where you saved the Apns certificate.

3. Import cert file

sudo keytool -importcert -alias AppleAAAPushCert -keystore /Library/Java/JavaVirtualMachines/jdk1.8.0_201.jdk/Contents/Home/jre/lib/security/cacerts -file ~/AppleAAAPushCert.crt

4. Reboot System or JVM

General OpenSslEngine problem

This is usually caused of the missing trust of Apns certification by JVM. And there are two ways to solve the problem:

1. Update AAA cert by the method mention above.
2. Use pushy setTrustedServerCertificateChain in Code