Sophos Mobile Control
34
10 System setup
10.1 Check your licenses
Sophos Mobile Control uses a user-based license scheme. One user license is valid for all devices assigned to that user. Devices that are not assigned to a user require one license each.
To check your available licenses:
1. On the menu sidebar, under SETTINGS, click Setup > System setup.
2. On the System setup page, click the License tab.
The following information is displayed:
■
Maximum number of licenses: Maximum number of device users (and unassigned devices) that can be managed.
If the super administrator did not set a quota for the customer, the number of licenses is limited by the overall number for the Sophos Mobile Control server.
■
Used licenses: Number of licenses in use.
■
Valid until: The license expiry date.
If you have any questions or concerns regarding the displayed license information, contact your
Sophos sales representative.
Note: To notify when the license is about to expire, Sophos Mobile Control sends several email reminders to all administrators, starting 30 days prior to the expiry date.
10.2 Apple Push Notification service certificates
To use the built-in Mobile Device Management (MDM) protocol of iOS devices, Sophos Mobile
Control must use the Apple Push Notification service (APNs) to trigger the devices.
APNs certificates have a validity period of one year. To notify when the certificate is about to expire, Sophos Mobile Control sends several email reminders to the administrators, starting 30 days prior to the expiry date.
The following sections describe the requirements that must be fulfilled and the steps you must take to get access to the APNs servers with your own client certificate.
10.2.1 Requirements
For communication with the Apple Push Notification Service (APNs), TCP traffic to and from the following ports must be allowed:
■
The Sophos Mobile Control server needs to connect to gateway.push.apple.com:2195
TCP (17.0.0.0/8)
administrator help
■
Each iOS device with Wi-Fi only access needs to connect to
*.push.apple.com:5223
TCP (17.0.0.0/8)
10.2.2 Create an APNs certificate
This procedure assumes that you have not uploaded a certificate for the Apple Push Notification service (APNs) to Sophos Mobile Control yet.
To renew an existing certificate, see
Renew an APNs certificate (page 35).
Tip: You can use the same certificate for several customers. See
Copy an APNs certificate to another customer
(page 37).
1. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the iOS
APNs tab.
The description on that tab guides you through the steps you have to perform to request a certificate from Apple and to upload it to Sophos Mobile Control.
2. In the Download certificate signing request step, click Download certificate signing
request.
This saves the certificate signing request file apple.csr
to your local computer. The signing request file is specific to the current customer.
3. You need an Apple ID. Even if you already have an ID, we recommend that you create a new one for use with Sophos Mobile Control. In the Create Apple ID step, click Create a new
Apple ID.
This opens an Apple web page where you can create an Apple ID for your company.
Note: Store the credentials in a safe place where your colleagues can access them. Your company will need these credentials to renew the certificate each year.
4. For your reference, enter your new Apple ID in the Apple ID field on the top of the iOS APNs tab.
When you renew the certificate each year, you must always use that same Apple ID.
5. In the Create or renew APNs certificate step, click Apple Push Certificates Portal.
This opens the Apple Push Certificates Portal.
6. Log in with your Apple ID and upload the certificate signing request file apple.csr
.
7. Download the
.pem
APNs certificate file and save it to your computer.
8. In the Upload APNs certificate step, click Upload certificate and then browse for the
.pem
file that you received from the Apple Push Certificates Portal.
9. Click Save to add the APNs certificate to Sophos Mobile Control.
Sophos Mobile Controls reads the certificate and displays the certificate details on the iOS APNs tab.
10.2.3 Renew an APNs certificate
This procedure assumes that you already have uploaded a certificate for the Apple Push Notification service (APNs) to Sophos Mobile Control that is about to be expire and needs to be renewed.
To create and upload a new certificate, see
Create an APNs certificate
(page 35).
35
Sophos Mobile Control
Important: On the Apple portal, it is important that you select the correct APNs certificate for renewal. If you renew the wrong certificate, you might need to re-enroll all iOS devices.
1. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the iOS
APNs tab.
2. In the Download certificate signing request step, click Download certificate signing
request.
This saves the certificate signing request file apple.csr
to your local computer.
3. Skip the step Create Apple ID. This step is only required if you are creating an APNs certificate for Sophos Mobile Control for the first time.
4. In the Create or renew APNs certificate step, click Apple Push Certificates Portal.
This opens the Apple Push Certificates Portal.
5. Log in with your Apple ID. This must be the same ID that you used for the creation of the initial
APNs certificate.
6. On the Apple Push Certificates Portal, click Renew next to your Sophos Mobile Control APNs certificate.
7. Upload the certificate signing request file apple.csr
you prepared before.
8. Download the
.pem
APNs certificate file and save it to your computer.
9. In the Upload APNs certificate step, click Upload certificate and then browse for the
.pem
file that you received from the Apple Push Certificates Portal.
10. Click Save.
11. When you are logged in as super administrator, there is an additional dialog that lists all customers that currently use the same APNs certificate as the super administrator customer, that is a certificate with the same Topic attribute.
■
■
Click Save for all customers concerned to renew the APNs certificate for all of these customers.
Click Save only for super administrator customer to renew the APNs certificate only for the super administrator customer.
Important:
If the following message is shown, you are not renewing the correct certificate:
"The topic of the new certificate does not correspond to the old one.
If devices have been
set up with the previous certificate, they have to be set up again. Do you really want to save
your changes?"
This message indicates that you are about to create a new APNs certificate with a different identifier. If you confirm the message, all existing iOS devices are not manageable any more and you have to re-enroll them.
For information how to select the correct certificate, see
Identify the correct APNs certificate for renewal (page 37).
36
administrator help
10.2.4 Copy an APNs certificate to another customer
You can copy a certificate for the Apple Push Notification service (APNs) to another customer within the same or a different installation of Sophos Mobile Control.
Important: If there already exists an APNs certificate at the target location, it is important that the Topic property of the certificate that you want to copy is identical to the Topic of the existing certificate. If you copy the wrong certificate, you might need to re-enroll all iOS devices of the customer.
Download the certificate from the source location:
1. Log in to the Sophos Mobile Control console as an administrator of the customer whose APNs certificate you want to copy.
2. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the iOS
APNs tab.
3. Make a note of the Topic value that is displayed in the certificate details.
4. Click Download certificate as PKCS #12 file.
5. In the confirmation dialog, the password for the certificate file is displayed. Make a note of that password and then click Download.
This saves the certificate file apns_cert.p12
to your local computer.
Upload the certificate to the target location:
6. Log in to the Sophos Mobile Control console as an administrator of the customer to whom you want to upload the certificate.
7. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the iOS
APNs tab.
8. If there already exists an APNs certificate, verify that the Topic value is identical to the value of the certificate you are about to copy.
9. In the Upload APNs certificate step, click Upload certificate and then browse for the apns_cert.p12
file that you downloaded before.
10. Enter the password and then click Apply.
11. Click Save.
10.2.5 Identify the correct APNs certificate for renewal
When you renew your Apple Push Notification service (APNs) certificate for the Sophos Mobile
Control server as described in Renew an APNs certificate (page 35), it is important that on the
Apple portal you select the correct APNs certificate for renewal.
This section describes how to identify the APNs certificate that is currently uploaded to the Sophos
Mobile Control server.
Retrieve the certificate identifier:
1. Log in to the Sophos Mobile Control console with an administrator account for the customer whose APNs certificate needs to be renewed.
2. On the menu sidebar, under SETTINGS, click Setup > System setup and then click the iOS
APNs tab.
37
