Transferring a Safari Push certificate between accounts

I was pretty excited about Safari Push Notifications when they were first launched and made sure they were implemented quickly for iOS Dev Weekly. Initially at least, they were a great success and while the vast majority of subscribers still prefer email or RSS, even today more than 5% still receive push notifications each week.

There has been a problem though! Since closing Shiny Development after selling Curated in 2016, the iOS Dev Weekly Website Push ID has been stranded on the old developer account of a company that no longer exists.

After searching everywhere to see if a transfer was possible, I contacted Apple and they confirmed that unfortunately there is no current way to move a Website Push ID to a new account.

I have now been renewing that old developer account for two years since the company closed and I’d really rather not have to keep the subscription going just to keep one Website Push ID active. So I got back in touch with Apple, and again they confirmed that I couldn’t transfer the ID. However, this time they did say that I could delete it from the old account, then re-create it on the new account. That was interesting, but what they couldn’t tell me was whether subscriber tokens created before the transfer would continue to receive notifications after the transition. Everyone I spoke to at Apple was incredibly helpful and wanted to answer the question, but after being passed around multiple teams I just couldn’t get an answer.

The downside to their suggestion was that the Website Push ID needs to be deleted from the old account before it can be re-created on the new one. Of course, deleting the Website Push ID also revokes the production certificate so it seemed like a scary thing to just do on the off chance that it’d work, especially as I’d have no way of contacting those subscribers to ask them to re-subscribe if it didn’t.

So instead I decided to test it out with a brand new Website Push ID that isn’t the iOS Dev Weekly one. I made the ID on the old account, set everything up and checked it was working. Then, deleted it and re-created it on the new account and set everything up again. I just finished that testing and…

IT WORKS 🎉

Basically, if you delete the Website Push ID on one developer account revoking that production certificate, then re-create the exact same Website Push ID on a new account with a new production certificate, push notifications will continue to be delivered to anyone who was subscribed before the transfer.

Some other notes from my testing:

  1. I tested sending a push notification after the old certificate had been revoked, but before the certificate had been replaced on my server and it also worked. Safari Push Notifications do not require the original certificate to be active on a developer account.
  2. I used a different CSR (and therefore a different key pair) on the new certificate, there’s no need to have the original CSR and private key for this to work.
  3. This all seems really robust now which is definitely not something I remember it being when we were originally developing these push features. I guess things became a little more reliable in the last five years.

I hope this is helpful to anyone else with the same problem!