Unable to access api.push.apple.com. 

You are unable to reach a managed mobile device and get the error message "Unable to access api.push.apple.com. Verify network connectivity and ensure the URL is not blocked."

Note: This document is applicable only for MDM On-Premise & Endpoint Central On-Premise.

Cause

This could happen due to various reasons, such as:

• Host and port blocked
• Expired APNs certificate
• Third-party filters like proxy, firewall settings etc.,

Resolution

Hosts & ports to be allowed

Ensure that the following ports are open:

MDM must connect to api.push.apple.com:443 using HTTP/2 and TLS 1.2 or later.

The domain 17.0.0.0/8 should be opened on the external firewall.

If mobile devices connect to the internet via Wi-Fi, ensure that TCP port 5223 is open in the firewall or proxy settings to allow outbound communication with Apple Push Notification service (APNs).

TCP port 443 should be opened on the firewall/proxy server to allow inbound and outbound communication.

Expired APNs certificate

Ensure the latest APNs certificate is uploaded on the MDM Server. If not, generate a new APNs and upload it on the MDM Server.

MDM server network settings

Ensure that the MDM server can connect to the internet without interruption.

• If your network uses a proxy, make sure the proxy settings are properly configured. Verify the username and password for proxy authentication to allow access to services like APNs.
• If there are any third-party web filters in place, ensure that the MDM server is whitelisted or has an exception to bypass those filters and maintain seamless internet connectivity. 

Note:

1. To verify whether the issue has been solved, you can retry establishing connection with the mobile device. On the MDM server, navigate to the Enrollment tab, click on Actions and select Verify Connectivity. If the above resolution does not work, try connecting to a different network.
2. Apple blocks connections with SSL Inspection/HTTPS Interception. If a web proxy is used, ensure HTTPS Interception is disabled for Apple domains.

If you're still unable to resove the issue, contact MDM Support ( mdm-support@manageengine.com).

Applies to: Scanning the mobile device, Distributing Apps, Associating Profiles

Keywords: MDM scanning, Associating profiles, APNs, Mobile Device Management