Apple APNs 2048 位 TLS/SSL 证书更新
今天我收到一封来自苹果的电子邮件，告诉我他们正在更改与推送通知相关的内容，并想询问如何处理他们给我链接的证书...我的服务器运行 debian lenny，我使用 php5 将推送通知发送到苹果 apns。我是否必须将其添加到某处，或者替换“旧”的？
Today i received an email from apple telling they are changing something connected with push notifications, and wanted to ask what to do with the certificate they gave me link to... My server runs debian lenny, and im using php5 to send push notifications to apple apns. Do i have to just like... add it somewhere, or replace the 'old' one ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
下载 entrust_2048_ca.cer 文件，并将其安装在与 Apple 通知服务通信的服务器上。无需更新您的实际推送证书，您也不必更改代码中的任何内容。
重要的是，实际与 Apple 通知服务通信的服务器已安装证书。
如果幸运的话，您的推送服务器已经与证书颁发机构根联系，这将自动为您解决问题。但是，如果您失去该连接，您的通知将无法正常运行，除非您拥有“本地”版本的证书。
Download the entrust_2048_ca.cer file, and install it on the servers that communicate with Apple's notification services. No need to do renew your actual push certificates, also you should not have to change anything in your code.
The important thing is that the servers that actually communicate with Apple's notification services have the certificate installed.
If you are lucky, your push server is already in contact with a Certificate Authority root, and this will solve the issue for you automagically. However, if you should lose that connection, your notifications will be out of order unless you have a "local" version of the certificate.
我正在寻找相同的解决方案，另一个论坛的快速提示说“只需下载 .cer 文件并安装它” http://www.iphonedevsdk.com/forum/iphone-sdk-development/66878-apns-question-email-apple.html 。
我们将在我们的 Linux 服务器上尝试，看看这是否适合您的情况。
I am looking for the same solution, a quick hint from another forum says "simply download the .cer file and install it" http://www.iphonedevsdk.com/forum/iphone-sdk-development/66878-apns-question-email-apple.html.
We will try on our linux server and please see if this works for your situation.
我下载并复制了 https://www.entrust.net/downloads/binary/entrust_2048_ca。将 cer 文件写入我的 OpenBSD 服务器上的 /etc/ssl 中。我没有更改任何服务器端代码，实际上没有以任何方式使用委托证书。 （我使用来自 Apple 供应网站的证书。）
12 月 23 日，我的通知将在带有或不带有委托证书的情况下发送和接收。我对到底应该如何使用 entrust cer 文件感到困惑。
我认为苹果邮件中的这句话告诉我我很好：
即
通知已经发送并且正在发送，因此我的服务器已经有它需要的东西。
更新：
我上面写的好像是这样的。如果您使用相当新的服务器，您可能根本不需要执行任何操作。自 2010 年 3 月以来，沙箱环境一直使用 2048 位。如果它一直在工作，那么您就已经设置好了。完整信息在这里：
http://www.24100.net/ 2010/12/latest-apple-push-notification-certificate-changes-decrypted/
I downloaded and copied the https://www.entrust.net/downloads/binary/entrust_2048_ca.cer file into /etc/ssl on my OpenBSD server. I haven't changed any of my server side code which is actually not using the entrust cert in any way. (I use the certs from Apple's provisioning site.)
On Dec 23rd, my notifications are sent and received with or without the entrust cert. I am confused about how exactly I am supposed to use the entrust cer file.
I think this sentence from the email from Apple tells me I am ok:
i.e.
Notifications were and are sent, hence my server already has what it needs.
UPDATE:
What I wrote above seems to be the case. If you use a fairly recent server you likely don't have to do anything at all. The sandbox environment has been using 2048 bits since March 2010. If it has been working, you are set. Full info here:
http://www.24100.net/2010/12/latest-apple-push-notification-certificate-changes-decrypted/
我连接到 Apple Push Server 的 PHP5 脚本托管在 Fedora 系统上。对我来说，迁移是透明的。尽管我在系统上找不到 Entrust 证书，但我无事可做。也许 PHP5 SSL 库可以使用它。
My PHP5 scripts that connect to the Apple Push Server are hosted on a Fedora system. For me, the migration was transparent. I had nothing to do despite I can't find the Entrust certificate somewhere on my system. Maybe is it available with the PHP5 SSL library.