Troubleshoot Error occurred while sending request to APNS WEB API

Check Network Connectivity

• Ping api.push.apple.com from the Silverback server and check if its trying to connect to some IP from Apple starting from 17. 

• Connect with telnet to api.push.apple.com with Port 443 and check that the connection is successful

Ensure to have Telnet Client Feature installed on the server and enter telnet api.push.apple.com 443	This indiciates that you can access the target server via port 443

• Open a browser and open https://api.push.apple.com and review if you receive the following message, which is positive

Check Application Pool

Review if the Silverback.apns application pool is Started and has the same settings like in the screenshot.

Check APNS Service

After the Network Connectivity and Application Pool tests, review the second component that is involved. This is the .Net core component.

• For this you can go to the following adjusted URL of your Silverback Server: e.g., https://silverback.imagoverum.com/apnssender/sendpush
• You will see here the following in case of an error

• Normally it should look like this:

• If your current Hosting Bundle is installed from Version 3 and you missed the updated prerequisites introduced with Silverback 23.0 and missed to update it to version 6 or to a non-supported version 7 or newer, you will find the following error message for the /apnssender/sendpush page

Review .Net Core Hosting Bundle Installation

• Look in the registry and in the control panel to see if the (correct) Hosting Bundle is installed at all.
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Updates\.NET Core
  • Probably the wrong Hosting Bundle is installed, like in the following example: Microsoft .Net Core Runtime - 3.1.22 (x64) or Microsoft .Net Core Runtime - 6.0.27 (x64)  is not the correct one. It should be the named as Windows Server Hosting as shown in the section below. 

Uninstall and Re-Install .Net Core Hosting Bundle

• Uninstall the current used .Net Core Hosting bundle
• Install the hosting bundle from this page: https://dotnet.microsoft.com/en-us/download/dotnet/6.0

• Afterwards check the system controls again and review if the  Microsoft Net Core 6.0.XX - Windows Server Hosting and several additional ASP.Net Core components are installed.

• Restart your Internet Information Service

Review APNS Sender

• Open the /apnssender/sendpush page again and it should look like this

• This is exactly what we want to see.

Enroll Device

• Enrolled the device again and review if it's going now successfully to managed:

Analyze Network Traffic

In case your device can still not be enrolled, please focus on your network traffic. 

• Install and Run Wireshark 
• Shortly before you install the MDM Profile on the start, start capturing packets
• Review after the profile installation if the server is starting to try to communicate at all
• To granularly filter traffic to Apple, add the following filter: ip.addr == 17.0.0.0/8
• The output should look similar to this:

• In case your output is empty, please review the incoming traffic after installing the MDM Profile on the device
• On your device, remove your MDM profile and get your public IP address, e.g. by opening whatismyip.com 
• Now open the Silverback SSP page, login and download a new MDM Profile
• Close now all Silverback related tabs in Safari and close Safari
• Right before installing the MDM Profile on the device, start capturing packets
• Now filter by your public IP-Address and review if the device is communicating to your server: ip.src == 89.247.127.244
• The output should look similar to this: 

Check Traffic on your Firewall / Proxy

• When Silverback is at the enrollment point communication to Apple, please review your outgoing network point in your environment and check if you can see Network Traffic in this direction on your Firewall or on your Proxy. If no traffic can be seen, check all the communication and check where the traffic might be blocked or gets lost. 

Check Telnet for Network Service

• Install on your Silverback Server the sysinternals tool psexec 
• Open your command with elevated privileges
  • Navigate to your installation folder that contains psexec.exe (e.g. C:\Tools\PsTools)
  • Now execute the following command to start cmd.exe as Network Service 

  • psexec -i -u "nt authority\network service" cmd.exe

  • Check if you are running under the Network with executing the whoami command
  • The answer should be nt authority\network service
  • Now execute the following command: api.push.apple.com 443 
  • The output should look like this:
  • 
• If you can connect, close this windows

Check Installed APNS Certificates for Network Service

• Now execute the following command to start mmc.exe as Network Service

  • psexec -i -u "nt authority\network service" mmc.exe

• Add the certificates snap-in
• Check if under personal your APNS certificate is present (review Thumbprints with the Certificates section in Silverback)
• In case you have multiple APNS certificates in the store, note down the serial number from the currently used one
• Review if you have under Trusted Root Certification Authorities, the correct AAA Certificate Services certificate present
  • Thumbprint: d1eb23a46d17d68fd92564c2f1f1601764d8e349
• Close the MMC

Open Apple API via Chrome as Network Service

• Now execute the following command to start Chrome as Network Service
  • psexec -i -u "nt authority\network service" "C:\Program Files\Google\Chrome\Application\chrome.exe" 
• Open https://api.push.apple.com
• You should be prompted with a certificate prompt 
• Select now your current APNS certificate, e.g. APSP:77d6963f-22b5-4a89-8fb6-083563e5d373
• After selecting your correct APNS certificate, the output should look like this

• Close Google Chrome

Check Invoke Command as Network Service

• Now execute the following command to start Powershell as Network Service

  • psexec -i -u "nt authority\network service" powershell.exe

• Enter the following commands step by step: 

$Body = @{
title = 'foo'
body = 'bar'
userId = 1 }

$JsonBody = $Body | ConvertTo-Json

$Params = @{
Method = "Post"
Uri = "https://api.push.apple.com"
Body = $JsonBody
ContentType = "application/json"
}

Invoke-RestMethod @Params

Review now the Server server answer and compare to the screenshot. With this answer you can verify if the server is able to receive an answer from the API. As we don't use HTTP/2 in this case, the answer should be a protocol violation.