Ios – apple push notification connection issue – key value mismatch check private key message

apple-push-notificationsiosiphone

I'm trying to test push notifications for my app, but can't connect to the apple sandbox with my certificate and private key. I'm following this tutorial.

I set up a new certificate and app id per the tutorial, set up a private key, and generated the .pem files for the certificate and the private key:

openssl x509 -in aps_developer_identity.cer -inform der -out PushTestCert.pem
openssl pkcs12 -nocerts -out PushTestKey.pem -in PushTestKey.p12

For the private key, it asks me to enter the original password the key, as well as a new one. I used the same password.

Then I test the connection to apple and am prompted for my password, and I enter the new password for the key .pem file, which is the same as the old password:

openssl s_client -connect gateway.sandbox.push.apple.com:2195 -cert PushTestCert.pem -key PushTestKey.pem
Enter pass phrase for PushTestKey.pem:
error setting private key
59244:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:/SourceCache/OpenSSL098/OpenSSL098-35.1/src/crypto/x509/x509_cmp.c:406:

Is there something I'm missing? On the iOS provisioning portal my app id says it is enabled for development (push). I've tried re-downloading the openssl certificate, no cigar.

Best Answer

Just to follow up, the reason this is probably happening is that you did not use the new public key to generate a push notification certificate for your app in developer.apple.com. So it can't match, because you private key does not match the public key used to generate the push notification cert

Related Solutions

Couldn’t able to connect to APNS Sandbox server

I ran into this same issue; what eventually resolved the error was to re-export the Entrust certificate from System Roots of OS/X Keychain Access application.

To be complete, I'll give a complete explanation of how I created the key/cert files (something which should have been in Apple's TechNote 2265: https://developer.apple.com/library/content/technotes/tn2265/_index.html)

Creating your APN-cert-and-key:

Run Keychain Access; select "login" Keychain and "My Certificates" category
Select the certificate with the name format of "Apple Development IOS Push Services: ..."
Export the certificate (in the menu, under "File" .. "Export Items")
Export to .p12 format.
This now contains your certificate and private key in an encrypted interchange format. The next step is to convert it to a passphrase protected .pem file
Using terminal, execute the following command (using your own filenames, of course):

openssl pkcs12 -in PushCertKey.p12 -out PushCertKey.pem

(You will need to enter the password for the .p12 file and provide another passphrase for the .pem file.)

If you really really really don't want a passphrase on the .pem file, try:

openssl pkcs12 -in PushCertKey.p12 -out PushCertKeyNoCrypt.pem -nodes

Creating CA Certificate file:

List item
Run Keychain Access application
Go to System Roots
Export the certificate named "Entrust.net Certification Authority (2048)" to a .pem file.

Note: My Roots container has four Entrust certificates; two of them with the name "Entrust.net Certification Authority (2048)" (but with different certificate extensions, via Get Info). Both of the "Entrust.net Certification Authority (2048)" certificates where effective in validating the trust chain; the other two Entrust certificates did not work. More significantly, the Entrust certificate pointed at by the Apple TechNote 2265 also does not work.

Make sure you export to .pem format; the default is .cer and this step is easy to miss.

Run the verification command:

openssl s_client -connect gateway.sandbox.push.apple.com:2195 -cert PushCertKey.pem -debug -showcerts -CAfile "Entrust.net Certification Authority (2048).pem"

This server and process assume that your are connecting to Apple's Dev sandbox APN server; if you are trying to use the production APN server, you will need to use the correct server and port.

For more information on openssl, I suggest the following pages:

Ios – Does the apple push notification distribution certificate signing request need to be the same as that used for the distribution cert to sign the app

it's perfectly fine to generate a new CSR. You just have the wrong private key in your .p12 file.

Generate the push certificate, then download it from Apple and double-click it to add it to your Keychain.

Open Keychain access, find the Push Certificate in "My Certificates", and expand it. You should see a private key underneath, that's the right one for this certificate. Select both the certificate and its private key, right click and select "Export 2 items…".

With the resulting .p12 file, everything should work fine.

Best Answer

Related Solutions

Couldn’t able to connect to APNS Sandbox server

Ios – Does the apple push notification distribution certificate signing request need to be the same as that used for the distribution cert to sign the app

Related Topic