# Feedback Assistant report — apsd cannot connect to APNs in macOS 27 virtual machines

**Suggested title:** macOS 27 beta 4 guest VM: apsd never connects to APNs — APSBAAClientIdentityProvider
fails to obtain a BAA certificate because SEP reference-key generation is unavailable in
Virtualization.framework guests; regression vs macOS 26, breaks MDM enrollment of VMs

**Area:** Virtualization / Apple Push Notification service
**Classification:** Regression (works on macOS 26 guests)

## Environment

- **Host:** Mac14,5 (Apple M2 Max, 32 GB), macOS 27.0 beta 4 (build 26A5388g)
- **Guest:** macOS 27.0 beta 4 (build 26A5388g), `VirtualMac2,1`, created **fresh** from the
  macOS 27 beta 4 IPSW with `VZMacOSInstaller` on this host
- **VM configuration:** `VZMacPlatformConfiguration` (persisted HardwareModel /
  `VZMacMachineIdentifier` / AuxiliaryStorage), `VZNATNetworkDeviceAttachment`, virtio entropy,
  vsock, virtiofs. First-boot account created with the new **`VZMacGuestProvisioningOptions`**
  (username/password + `logsInAutomatically`). Guest serial number is present and well-formed
  (`Z2GYXWJ7TQ`); the host-side `com.apple.AppleVirtualPlatform.Identity.Virtio.vzplugin`
  process is attached to the running VM. Exactly one macOS VM runs at a time (no duplicate
  machine-identifier scenarios).

## Summary

In a macOS 27 beta 4 guest, apsd **never opens a courier connection** to APNs. Before dialing, apsd
now asks `APSBAAClientIdentityProvider` for a BAA client certificate; that requires
MobileActivation to create a SEP-backed reference key, which is impossible in a Virtualization
guest (no Secure Enclave key generation), so apsd concludes it has no identity and deliberately
declines to connect. Result: no push token is ever issued to the guest.

Observable consequences:

- `apsctl status` (production environment) shows a rising "consecutive connection failures" count
  with **zero packets ever sent to 17.0.0.0/8** — the failure is pre-socket.
- MDM enrollment of the VM breaks: after a successful User-Approved enrollment the device delivers
  `Authenticate` to the MDM server but can never send `TokenUpdate` (it has no push token and no
  PushMagic), so the device never polls the command channel and queued commands are undeliverable
  by push. This makes macOS VMs — a primary MDM test vehicle — unmanageable on 27.
- Presumably all push-dependent guest features are equally affected.

On **macOS 26 (Tahoe) guests, APNs works** (iCloud in VMs functions, MDM test VMs receive pushes),
with the same underlying inability to generate SEP keys — the courier identity there does not
require the BAA path. This is therefore a behavior change in the macOS 27 apsd.

## Steps to reproduce

1. On a macOS 27 beta 4 Apple-silicon host, create a VM from the macOS 27 beta 4 restore image
   (`VZMacOSInstaller`, standard `VZMacPlatformConfiguration` per the "Running macOS in a virtual
   machine on Apple silicon" sample, NAT networking).
2. First boot with `VZMacOSVirtualMachineStartOptions.setGuestProvisioning(...)` supplying a
   username/password, `logsInAutomatically = true`, `enablesRemoteLogin = true` (SSH makes the
   inspection below convenient; the bug reproduces without it).
3. In the guest:
   `log stream --debug --predicate 'process == "apsd"'`
   and/or
   `sudo /System/Library/PrivateFrameworks/ApplePushService.framework/apsctl status`

## Actual results

apsd loops on connection attempts that fail in ~3.5 ms without any socket being opened:

```
apsd [com.apple.apsd:courier] APSBAAClientIdentityProvider failed to obtain a BAA cert, error:
  Error Domain=com.apple.MobileActivation.ErrorDomain Code=-1 "Failed to create reference key."
  UserInfo={... NSUnderlyingError=... Code=-1 "Failed to create ref key."
  {... NSOSStatusErrorDomain Code=-25308 "Failed to generate keypair"
   (errKCInteractionNotAllowed / errSecInteractionNotAllowed: Interaction is not allowed with the
    Security Server.)
   {... NSOSStatusErrorDomain Code=-25308 "<sepk:* kid=0000000000000000>: unable to generate key"}}}
apsd [com.apple.apsd:courier] <APSUserCourier … production …> underlying identity provider has
  identity to connect? NO
apsd [com.apple.apsd:courier] <APSCourierConnectionManager … production>: Stream error occurred …
  Error Domain=APSErrorDomain Code=1 "Told not to connect after fetching server bag: (null) -
  closing stream"
apsd [com.apple.apsd:courier] <APSCourierConnectionManager … production>: Disconnected in response
  to connection failure on interface NonCellular. (Consecutive failures: 12) isConnected NO …
  Connected on 0 interfaces.
apsd [com.apple.PersistentConnection:com.apple.apsd(push.apple.com)-NonCellular] Advising client to
  enter reconnect mode in response to a connection failure after elapsed time from start 0.0035…s
```

A client process asking for its token receives none:

```
mdmclient [com.apple.apsd:connection] <APSConnection …> Delivering publicToken from apsd: (null)
mdmclient [com.apple.apsd:connection] <APSConnection …> Delivering connectionStatusChange from apsd: NO
```

## Expected results

apsd establishes its courier connection in a Virtualization guest (as on macOS 26 guests) — either
via a non-SEP client identity fallback, or via an identity minted through the virtual-platform
identity mechanism that macOS 15+ already provides to VMs.

## What has been ruled out

- **Networking:** from the guest, TCP 5223 to `courier.push.apple.com` connects, the plain-HTTP
  bag fetch from `init-p01st.push.apple.com` succeeds, `openssl s_client` validates the APNs chain,
  and `scutil` reports the courier reachable. Packet capture confirms apsd itself sends nothing.
- **Device identity basics:** valid serial, persisted machine identifier/aux storage, VM created
  fresh from a 27 IPSW on a 27 host, host-side AppleVirtualPlatformIdentity plugin attached.
- **State corruption:** deleting `/Library/Keychains/apsd.keychain` and rebooting re-provisions the
  keychain and resets the failure counter, then fails identically.
- **Concurrency:** exactly one macOS VM running; no duplicate `VZMacMachineIdentifier` in use.

## Impact

MDM enrollment of macOS VMs is a standard industry workflow (MDM vendors, admins, and CI all test
management flows against Virtualization-framework guests, and PPPC/notification-settings payloads
are honored only when MDM-delivered). On macOS 27 beta 4 a VM can enroll (Authenticate succeeds)
but can never complete `TokenUpdate`, so no MDM can manage a macOS 27 VM. If BAA-backed client
identity is intended to become mandatory for APNs, virtual machines need a supported path to
satisfy it (e.g., via the host-SEP-derived VM identity introduced in macOS 15).

## Questions

1. Is the BAA client-identity requirement for apsd courier connections intentional on macOS 27,
   and is the lack of a fallback in virtual machines a known issue?
2. Is there a sysdiagnose/feedback profile you'd like attached from the guest and/or host?