This article provides answers to frequently asked questions onCitrix Secure Mail APNS forIT Admins.For more information on Push Notifications for Secure Mail, refer to Citrix Documentation - Rich Push Notifications for Secure Mail for iOS. ## _General Overview_ ### Q1: Why does Secure Mail for iOS require APNS notifications? **A** : In Avatar and previous releases, when Secure Mail application is in the background, it relies on background app refresh functionality of the iOS platform to “wake up” the application to: 1. Update the badge 2. Show notifications (if turned on) 3. Sync emails The frequencyalgorithm to wake up the application is more or less depending on the app usage (the more frequent the app is in use the more frequent it checks for new mail while in background mode). Therefore, at times the badge orthemailswill not sync for hours. For customers who want near real time of badge update and a higher frequency of mail syncing, it is recommended to use Secure Mail with Push Notifications. ### Q2: Is APNS notification an optional feature in Beetlejuice for Secure Mail for iOS? **A** : Yes, it is an optional feature in BeetleJuice. It is turned off by default. The Admin will have to enable the feature (as an app specific policy in AppC/ XMS server). If the customer is ok with background app refresh approach when Secure Mail is in background, then this feature does notneed to be enabled. ### Q3: How about push notifications for Secure Mail for Android? **A** : Android OS allows 3rd party applications to maintain server connections both in foreground and background mode. Hence, Secure Mail for Android maintains a persistent ActiveSync connection to sync emails and sync is near real time. ### Q4: Will APNS feature in Secure Mail for iOS work with both XM 9 and XM 10 servers? **A** : Yes ### Q5: What are the supported upgrade paths? **A** : The following table provides supported upgrade paths. ![User-added image](/servlet/rtaImage?eid=ka64z000000PR6F&feoid=00N0z0000031cS5&refid=0EM60000000Q0qE) Key points (to elaborate on the above table) * APNs support requires a unique App ID (Apple iOS requirement). Therefore, this solution will be supported for Secure Mail wrapped with a Unique App ID. Secure Mail that is using a provisioning profile created with a wildcard App ID is not supported for APNs. * It is not possible to upgrade a wildcard App ID wrapped Secure Mail to a Unique App ID wrapped Secure Mail on the users device. A re-install is required. So, for older customers wanting to leverage this push service, you will need to create a Unique App ID in the Apple Developers portal, a new provisioning profile, a new wrapped version of Secure Mail then load this up to the server as a new app. ### Q6: Will the APNs feature work with Office365? **A** : Yes, O365 is supported in addition to Exchange 2007, 2010 and 2013. ### Q7: Is the APNs feature available for Lotus Notes? **A** : The Beetlejuice release (10.0.7) only supports Exchange. We will investigate on what web services are available for Lotus Notes. When the due diligence is completed, we will provide a status update. ### Q8: Do I need to install any server components on-premise? **A** : No. Citrix will host a “listener” service in the cloud. This service will send out push notifications to your user’s Secure Mail application. Note that no personally identifiable information (PII) is stored or flows through this cloud service. ### Q9: Why did you go with a cloud first approach for listener service? **A** : Key reasons are: * Zero on-premise server footprint to support APNS notifications * No hardware/ software/ monitoring/ server scaling work effort for IT administrators * No change to mail data flow * Mail data traffic continues to flow between Device and Exchange Server * No sensitive data sent to listener service by Exchange server * APNS notification sends only the badge count to Secure Mail application. ### Q10: Why does the feature require a listener service? The Native Mail client does not need a listener service. **A** : The native mail client on iOS maintains a persistent ActiveSync connection with the exchange server. Apple allows this only for the native mail client. 3rd party mail clients have to leverage APNs to send remote notifications. In order to support APNs, a server component is required. The server component receives a trigger from the exchange server and then send an APNs notification to Secure Mail application. ### Q11: Where is the listener service hosted? **A** : The listener service is hosted on Amazon Web Services (AWS). It is configured as an HA/DR service. The listener service will be available in three regions – Americas, EMEA, APAC. The IT admin will have to select the region that is closest to the Exchange Server. ### Q12: What is the Citrix hosted listener service URL? The listener service URLs and IP addresses are based on region: \- Americas: * https://us-east-1.pushreg.xm.citrix.com * 52.7.65.6; 52.7.147.0 --- \- EMEA: * https://eu-west-1.pushreg.xm.citrix.com * 54.154.200.233; 54.154.204.192 \- APAC: * https://ap-southeast-1.pushreg.xm.citrix.com * 52.74.236.173; 52.74.25.245 ## _Configurationand Setup_ ### Q1: What does the customer IT admin need to do to enable APNs push notifications for WM? **A** : The document by the Mobility Experts team provides step-by-step instructions and screenshots to set up APNs notifications, Citrix Blog - Mobility Experts: A Step-by-Step Guide to Configuring Secure Mail APNS ### Q2: Can I use the MDM server APNs certificate for my Secure Mail App ID? **A** : No. The MDM server APNs certificate is required to enable XDM/ XMS manage iOS devices. The Secure Mail APNs certificate is required to support APNs push notifications for the Secure Mail application. ### Q3: How do I generate the APNs certificate for Secure Mail? **A** : The APNs certificate for Secure Mail application is generated by IT admin using the Apple developer portal. This is the same portal used to register the app with Apple (with a specific app ID). When the APNs certificate is generated, the IT admin can upload that using the Xenmobiletools portal. For more information, refer to the step-by-step instructions from Apple on generating and exporting APNs certificates - Configuring Push Notifications. ### Q4: How do I renew the APNs certificate for Secure Mail when it expires? **A** : A new APNs certificate should first be generated via the Apple developer portal and exported. You then go to xenmobiletools.citrix.com and update the certificate that has been previously uploaded for Secure Mail. This is done by selecting the‘Update’ action for the Secure Mail app ID in the uploaded certificates list. ### Q5: The Exchange server is behind a firewall. Do I need to allow outbound connection to the Citrix hosted listener service? **A** : Yes. Ensure outbound SSL connections are not blocked by the Firewall to the Citrix hosted service for your region: \- Americas: * https://us-east-1.mailboxlistener.xm.citrix.com * 52.6.252.176; 52.4.180.132 --- \- EMEA: * https://eu-west-1.mailboxlistener.xm.citrix.com * 54.77.174.172; 52.17.147.220 \- APAC: * https://ap-southeast-1.mailboxlistener.xm.citrix.com * 52.74.231.240; 54.169.87.20 ### Q6: How do I configure Exchange to reach the listener service when there is a proxy server? **A** : If you have a proxy server, you should allow Exchange to bypass the proxy and route traffic directly to the listener service: * On Exchange for EWS, make the following update to the XML in the web.config file in the ClientAccess\exchweb\ews folder: