How to verify Parse running on Heroku supports new Apple Push Notification root cert?

user_6962 0
Viewed 259

Apple says:

On March 29, 2021, token and certificate-based HTTP/2 connections to the Apple Push Notification service must incorporate the new root certificate (AAACertificateServices 5/12/2020) which replaces the old GeoTrust Global CA root certificate. To ensure a seamless transition and to avoid push notification delivery failures, verify that both the old and new root certificates for the HTTP/2 interface are included in the Trust Store of each of your notification servers before March 29.

We want to verify that this won't break things for a Parse server running on Heroku. How would we go about this?

parse-platform push-notification heroku ios
1 Answers

This is what we did – I'm not 100% confident about it, so let me know if I missed anything.

Via https://github.com/parse-community/node-apn/issues/49, we learned that Node uses its own list of root certs, independent of the underlying OS.

Then, we ran

heroku run "node -v" -a my-parse-installation

and found that it uses Node 15.8.0.

Then we checked https://github.com/nodejs/node/blob/v15.8.0/src/node_root_certs.h, confirming by searching for part of the certificate contents that it included both the new "AAA" cert and the old "GeoTrust" cert. (It did.)

We found both certs linked from https://developer.apple.com/documentation/usernotifications/setting_up_a_remote_notification_server/. So we looked there to know what to search for.

(Initially we tried stuff like curling to Apple's server from the Heroku server and were confused by the fact that it got errors, while push notifications via Parse still worked. But this is explained by the fact that Node uses its own certs per above.)

user_69620
Related