Parse-server: Setting production to true with a Production APNS .p12 File crashes server

[liltimtim]

We use GitHub Issues for bugs.

If you have a non-bug question, ask on Stack Overflow or Server Fault:

• https://stackoverflow.com/questions/tagged/parse.com
• https://serverfault.com/tags/parse

You may also search through existing issues before opening a new one: https://github.com/ParsePlatform/Parse-Server/issues?utf8=%E2%9C%93&q=is%3Aissue

--- Please use this template. If you don't use this template, your issue may be closed without comment. ---

Issue Description

Setting production property to true using a production APNS certificate crashes application. Setting to false does not.

Steps to reproduce

push: {
        ios: [
            //create and support both sandbox and production
            {
                pfx:sandboxDirectoryLocation,
                passphrase: config.APNS_PASSPHRASE,
                bundleId: config.APPLE_BUNDLE_ID,
                production: false
            },
            {
                pfx:productionDirectoryLocation,
                passphrase: config.APNS_PASSPHRASE,
                bundleId: config.APPLE_BUNDLE_ID,
                production: true
            }
        ]
    }

1. Go to dashboard and send a test push
2. Server crashes with error

To fix:

1. set both production to false
2. push notifications succeed
3. server does not crash

Expected Results

What I expect to happen is that the server detects the correct environment and doesn't crash. For example, I know I have a sandbox certificate so I know I need to set production to false. If I know I have a production certificate then I know I need production to be set to true.

Actual Outcome

Server crashes with error:

Error: certificate does not support configured environment, production: true
    at validateCredentials (/Volumes/Big Disk/Documents/Project/LP-Parse-Server-Template/node_modules/apn/lib/credentials/validate.js:19:10)

Environment Setup

• Server

  • parse-server version (Be specific! Don't say 'latest'.) : 2.4.2
  • Operating System: macOS Sierra (10.12.5)
  • Hardware: iMac Retina 5k, 27-inch late 2014
  • Localhost or remote server? (AWS, Heroku, Azure, Digital Ocean, etc): localhost

• Database

  • MongoDB version: 3.2.11
  • Storage engine: Unknown
  • Hardware: iMac Retina 5k, 27-inch late 2014
  • Localhost or remote server? (AWS, mLab, ObjectRocket, Digital Ocean, etc): localhost

Logs/Trace

Error: certificate does not support configured environment, production: true
at validateCredentials (/Volumes/Big Disk/Documents/Project/LP-Parse-Server-Template/node_modules/apn/lib/credentials/validate.js:19:10)
at /Volumes/Big Disk/Documents/Project/LP-Parse-Server-Template/node_modules/apn/lib/connection.js:163:5
at _fulfilled (/Volumes/Big Disk/Documents/Project/LP-Parse-Server-Template/node_modules/q/q.js:854:54)
at Promise.then.Q.nextTick.self.promiseDispatch.done (/Volumes/Big Disk/Documents/Project/LP-Parse-Server-Template/node_modules/q/q.js:883:30)
at Promise.e.Promise.promise.promiseDispatch (/Volumes/Big Disk/Documents/Project/LP-Parse-Server-Template/node_modules/q/q.js:816:13)
at /Volumes/Big Disk/Documents/Project/LP-Parse-Server-Template/node_modules/q/q.js:624:44
at runSingle (/Volumes/Big Disk/Documents/Project/LP-Parse-Server-Template/node_modules/q/q.js:137:13)
at flush (/Volumes/Big Disk/Documents/Project/LP-Parse-Server-Template/node_modules/q/q.js:125:13)
at _combinedTickCallback (internal/process/next_tick.js:67:7)
at process._tickDomainCallback (internal/process/next_tick.js:122:9)

[flovilmart]

Your issue is located in the apn module as it seems, please open it there.

[natanrolnik]

Besides that, make sure you have generated a production push certificate, and not a development one. Apparently, when you try to set production to true in a development push certificate, apn crashes.

[liltimtim]

It would be very much appreciated if when someone opens up a ticket it was t immediately closed as being in the "wrong module". This would create a more higher quality knowledge base given that I don't know exactly why or where the issue is springing from. You also have zero references to other hit hub or module locations for other people to follow as well in case they arrive here from a google search.

I request that the issue be re-opened until someone can give a more higher quality response than the one currently given by the closer of this ticket.

Where is this "Apn module" GitHub repo?

Nathan, I ensured I have a production very generated as I've tested the production cert with software that the documentation recommends.

[flovilmart]

This issue has been raised numerous times, over and over again.
First, the apn modules is handled by parse-server-push-adapter, not Parse-server itself.
Second a quick google search for 'node apn' would yield the answer you're looking for. (https://encrypted.google.com/search?hl=en&q=node%20apn)
Third, the error message look explicit enough: 'Certificate don't support specified environment'

[liltimtim]

For reference I'm assuming the apn module mentioned you are referring too is https://github.com/node-apn/node-apn

See was that so hard? Thank you for your time

[flovilmart]

@liltimtim I'm not ok with accepting such familiarity and condescending tone

[liltimtim]

@flovilmart you are interpreting what I'm saying incorrectly so there is nothing for you to accept.

I simply stated that you closed this issue with a low quality answer (no links given to the reference library or where exactly to report this issue).

I recommend you read and follow this guide https://stackoverflow.com/help/how-to-answer

specifically the part about "Posting relevant links". It will help you formulate better responses especially when others (like myself), take the time to properly fill out the template when posting questions. I took the time to fill out that form in its entirety (except for the database driver as I'm unsure what exactly Parse uses under the hood to communicate with Mongo DB (be that the native driver or not). As such, I expect answers to at least give a more robust reference and to help out others who have the same issue.

You yourself stated that this APN issue "has been raised numerous times". If that is the case, I could not find it in this repo by searching for closed topics. My goal here was to possibly raise a bug and help someone who may need it.

[flovilmart]

You may have taken the time to fill the form, but haven't searched for similar issues or even read the exception that was thrown.

Also, this is not stackoverflow, this is github issues, perhaps you should ask questions there instead, perhaps you could have investigated the issue, perhaps on Good old google: https://encrypted.google.com/search?hl=en&q=Error%3A%20certificate%20does%20not%20support%20configured%20environment%2C%20production%3A%20true

[liltimtim]

Firstly, the points given on Stackoverflow are valid methodologies to answering any question in an online forum / format. Its points are not specific to SO in particular. Secondly @flovilmart as I'm stating below, most of the issue that I've seen are with people generating incorrect .pem or .p12 apple certs. My certificates work (tested outside of Parse with Firebase Cloud Messaging). They ALSO work in Parse given that the environment is set to false (no server crash). Third, don't assume I haven't researched otherwise I wouldn't have taken the time to fill out the template ;)

As stated in my bug report, setting production to false for both certificates makes the server perform correctly in both environments (production and sandbox) which is in stark contrast to the documentation. http://docs.parseplatform.org/parse-server/guide/#api

The issue I'm having is that the documentation vs. the behavior is strange. Production certs work as expected even though a false is passed into the configuration when setting up parse. Don't know why and I don't know if its related too Parse or as @flovilmart stated (APN Module).

My Research:

https://github.com/node-apn/node-apn/issues/245
this issue concluded that it was the Apple Push Certificate and it was invalid (not my issue)

https://github.com/node-apn/node-apn/issues/346
this issue concluded that is was again Apple Push Certificate (guy regenerated certs and it worked) (again not my issue)

https://github.com/node-apn/node-apn/issues/253
this issue reports user is using the .pem file according to the documentation I can use a .p12 file (which is what I'm using not a .pem file).

If anyone is interested I can share the full list of URL's I have traveled too along with a summary of each.

Almost all other links I've followed has been the same thing, they did not generate the certificate correctly, their passphrase was wrong, Apple made a transition of how servers connected / used APN services, etc. My issue is a behavior issue vs. documentation issue. Why is it that my push certs work in both environments production and sandbox but only if production flag is set to false?

[flovilmart]

Again, you should ask that question on node-apn, as this module is responsible for the error. Not sure why you keep arguing here

[liltimtim]

Not arguing, simply updating this issue in case someone else arrives here when searching for a solution. Its frustrating (to me at least) to arrive to a place and have a solution in another location and you cannot easily find it. Did post an issue and will post URL once solution is found.

[flovilmart]

You should actually open it in the https://github.com/parse-server-modules/parse-server-push-adapter as it's not managed by that project either... In any case, this issue has nothing to do with that project.

[wujohns]

@liltimtim The better way is to write a post about node-apn. The function of the issues is for developing. If a problem has a sure answer and it's not a bug or new feature, why not closing it

[liltimtim]

Issue solved: https://github.com/node-apn/node-apn/issues/410

This issue wasn't related too Node-APN per say. Apple now allows switching with the same certificate. So I can use the same cert Production / Sandbox and use the production flag as the documentation stated.

However passing both certificates as the Parse documentation states, breaks things.

the solution to the issue was to use a single non-array value

ios: 
            {
                pfx:productionDirectoryLocation,
                passphrase: config.APNS_PASSPHRASE,
                bundleId: config.APPLE_BUNDLE_ID,
                production: true
            }

This was most likely my fault for not interpreting the Parse documentation correctly. Although its sort of misleading when it states you can support both production and sandbox by passing in an array of certificates (sandbox and production certs) even though Apple generates an "omni cert" so to speak. Using the omni certificate and passing only a single certificate with either production true or false worked as expected.

[flovilmart]

The documentation was written before the 'omni' cert was a thing, it perhaps should be updated or just left as is

[liltimtim]

No problem, it just required digging through APN node documentation and not following Parse documentation after all.

[flovilmart]

The docs are open source, feel free to open a pull request to reference that issue directly in the docs.

[natanrolnik]

@liltimtim Glad you found the reason of the problem, and thanks for posting here.
As @flovilmart mentioned, we would greatly appreciate a Pull Request updating the docs:
https://github.com/parse-community/docs/blob/gh-pages/_includes/parse-server/push-notifications.md