Cert and Token Expiry

Cert & Token Expiry

See when a Jamf Pro server's Apple push certificate, Automated Device Enrollment tokens and Volume Purchasing tokens expire, and whether it uses an External CA. Read-only.

When one of these lapses, devices stop checking in, stop enrolling or stop getting apps. This tool puts all the expiry dates in one place.

How to use it

Enter the server details and click Connect & Scan. There's no separate permission screen. The scan checks, in order:

Check	Source
APNs Push Certificate	Jamf Pro's own push certificate expiry warning (see below)
Certificate Authority	Whether an External CA is configured, or the server uses Jamf Pro's built-in CA, and when the active CA certificate expires
Device Enrollment (ADE)	Every Automated Device Enrollment (DEP) server token
Volume Purchasing (VPP)	Every volume purchasing location's token. If the Jamf Pro API list can't be read, the Classic API's volume purchasing accounts are used instead

Results

Each item gets a status from the days left until it expires:

Status	Days left
Expired	Already expired
Critical	Fewer than 30
Warning	30 to 89
OK	90 or more
Unknown	No expiry date could be read. The row explains why
Info	No date to show. Used for the External CA row, and for the push certificate when Jamf Pro gives no exact date

Counts for Expired, Critical, Warning and OK are shown at the top. Items are listed most urgent first, and you can filter by status, including Unknown. Expired items show how long ago they expired, for example Expired 3d ago, or Expired <1d ago.

If no ADE or VPP tokens are set up on the server, the row says None configured. Unknown means the list or the date couldn't be read, and the row explains why.

APNs Push Certificate

Jamf Pro doesn't make the push certificate's expiry date available through its API. What it does do is raise its own push certificate expiring or push certificate expired notification, about 30 days before the certificate expires. This tool reads those notifications:

Result	Meaning
A date and status	Jamf Pro's warning included the expiry date, so the row is graded like any other
Expiring soon — Jamf Pro has flagged this certificate (within ~30 days)	Jamf Pro has warned that the certificate will expire soon, but gave no exact date
Expired — Jamf Pro has flagged this certificate as expired	Shown with the Expired status
No expiry warning from Jamf Pro	The certificate isn't within Jamf Pro's ~30-day warning window. It isn't a guarantee it's valid for long, so check the exact date in Jamf Pro
Could not fetch / Could not read Jamf Pro's notifications list	The notifications couldn't be read. Shown as Unknown

For the exact expiry date, check Settings → Global Management → Push Certificates in Jamf Pro.

External CA

The External CA row has no date. It shows Info with one of these:

Result	Meaning
Configured	An External CA is set up in Settings → Global Management → PKI Certificates
Not configured — using Jamf's built-in CA	The server uses Jamf Pro's own CA
Likely configured (heuristic) / Likely not configured — built-in CA (heuristic)	Jamf Pro didn't say directly, so the answer was worked out from the certificate's issuer and subject. Check it in Jamf Pro
Could not determine	The CA details couldn't be understood. Check Settings → Global Management → PKI Certificates in Jamf Pro
Could not fetch	The CA details couldn't be read. Shown as Unknown

Active CA Certificate

A second row shows when the active CA certificate expires, graded like the other rows, with its subject. If the date can't be read, the row says so.

Export

Export HTML saves CertExpiry_<server>.html with the counts and a section per type that you can filter by status. The Certificate Authority section has no Expires column. Scan Again returns to the start.

Tips

• Run it regularly, or before a renewal date, so nothing lapses unnoticed.
• Apple push certificates must be renewed with the same Apple Account that created them. Renewing with a different one means re-enrolling every device.

Permissions: read access to Jamf Pro notifications (for the push certificate), PKI (certificate authority), Automated Device Enrollment and Volume Purchasing Locations. If one can't be read, that row shows Unknown (or Could not fetch for the External CA row) and the rest of the scan continues.