Feedback Assistant report — apsd cannot connect to APNs in macOS 27 virtual machines

Suggested title: macOS 27 beta 4 guest VM: apsd never connects to APNs — APSBAAClientIdentityProvider fails to obtain a BAA certificate because SEP reference-key generation is unavailable in Virtualization.framework guests; regression vs macOS 26, breaks MDM enrollment of VMs

Area: Virtualization / Apple Push Notification service Classification: Regression (works on macOS 26 guests)

Environment

Host: Mac14,5 (Apple M2 Max, 32 GB), macOS 27.0 beta 4 (build 26A5388g)
Guest: macOS 27.0 beta 4 (build 26A5388g), VirtualMac2,1, created fresh from the macOS 27 beta 4 IPSW with VZMacOSInstaller on this host
VM configuration: VZMacPlatformConfiguration (persisted HardwareModel / VZMacMachineIdentifier / AuxiliaryStorage), VZNATNetworkDeviceAttachment, virtio entropy, vsock, virtiofs. First-boot account created with the new VZMacGuestProvisioningOptions (username/password + logsInAutomatically). Guest serial number is present and well-formed (Z2GYXWJ7TQ); the host-side com.apple.AppleVirtualPlatform.Identity.Virtio.vzplugin process is attached to the running VM. Exactly one macOS VM runs at a time (no duplicate machine-identifier scenarios).

Summary

In a macOS 27 beta 4 guest, apsd never opens a courier connection to APNs. Before dialing, apsd now asks APSBAAClientIdentityProvider for a BAA client certificate; that requires MobileActivation to create a SEP-backed reference key, which is impossible in a Virtualization guest (no Secure Enclave key generation), so apsd concludes it has no identity and deliberately declines to connect. Result: no push token is ever issued to the guest.

Observable consequences:

apsctl status (production environment) shows a rising "consecutive connection failures" count with zero packets ever sent to 17.0.0.0/8 — the failure is pre-socket.
MDM enrollment of the VM breaks: after a successful User-Approved enrollment the device delivers Authenticate to the MDM server but can never send TokenUpdate (it has no push token and no PushMagic), so the device never polls the command channel and queued commands are undeliverable by push. This makes macOS VMs — a primary MDM test vehicle — unmanageable on 27.
Presumably all push-dependent guest features are equally affected.

On macOS 26 (Tahoe) guests, APNs works (iCloud in VMs functions, MDM test VMs receive pushes), with the same underlying inability to generate SEP keys — the courier identity there does not require the BAA path. This is therefore a behavior change in the macOS 27 apsd.

Steps to reproduce

On a macOS 27 beta 4 Apple-silicon host, create a VM from the macOS 27 beta 4 restore image (VZMacOSInstaller, standard VZMacPlatformConfiguration per the "Running macOS in a virtual machine on Apple silicon" sample, NAT networking).
First boot with VZMacOSVirtualMachineStartOptions.setGuestProvisioning(...) supplying a username/password, logsInAutomatically = true, enablesRemoteLogin = true (SSH makes the inspection below convenient; the bug reproduces without it).
In the guest: log stream --debug --predicate 'process == "apsd"' and/or sudo /System/Library/PrivateFrameworks/ApplePushService.framework/apsctl status

Actual results

apsd loops on connection attempts that fail in ~3.5 ms without any socket being opened:

apsd [com.apple.apsd:courier] APSBAAClientIdentityProvider failed to obtain a BAA cert, error:
  Error Domain=com.apple.MobileActivation.ErrorDomain Code=-1 "Failed to create reference key."
  UserInfo={... NSUnderlyingError=... Code=-1 "Failed to create ref key."
  {... NSOSStatusErrorDomain Code=-25308 "Failed to generate keypair"
   (errKCInteractionNotAllowed / errSecInteractionNotAllowed: Interaction is not allowed with the
    Security Server.)
   {... NSOSStatusErrorDomain Code=-25308 "<sepk:* kid=0000000000000000>: unable to generate key"}}}
apsd [com.apple.apsd:courier] <APSUserCourier … production …> underlying identity provider has
  identity to connect? NO
apsd [com.apple.apsd:courier] <APSCourierConnectionManager … production>: Stream error occurred …
  Error Domain=APSErrorDomain Code=1 "Told not to connect after fetching server bag: (null) -
  closing stream"
apsd [com.apple.apsd:courier] <APSCourierConnectionManager … production>: Disconnected in response
  to connection failure on interface NonCellular. (Consecutive failures: 12) isConnected NO …
  Connected on 0 interfaces.
apsd [com.apple.PersistentConnection:com.apple.apsd(push.apple.com)-NonCellular] Advising client to
  enter reconnect mode in response to a connection failure after elapsed time from start 0.0035…s

A client process asking for its token receives none:

mdmclient [com.apple.apsd:connection] <APSConnection …> Delivering publicToken from apsd: (null)
mdmclient [com.apple.apsd:connection] <APSConnection …> Delivering connectionStatusChange from apsd: NO

Expected results

apsd establishes its courier connection in a Virtualization guest (as on macOS 26 guests) — either via a non-SEP client identity fallback, or via an identity minted through the virtual-platform identity mechanism that macOS 15+ already provides to VMs.

What has been ruled out

Networking: from the guest, TCP 5223 to courier.push.apple.com connects, the plain-HTTP bag fetch from init-p01st.push.apple.com succeeds, openssl s_client validates the APNs chain, and scutil reports the courier reachable. Packet capture confirms apsd itself sends nothing.
Device identity basics: valid serial, persisted machine identifier/aux storage, VM created fresh from a 27 IPSW on a 27 host, host-side AppleVirtualPlatformIdentity plugin attached.
State corruption: deleting /Library/Keychains/apsd.keychain and rebooting re-provisions the keychain and resets the failure counter, then fails identically.
Concurrency: exactly one macOS VM running; no duplicate VZMacMachineIdentifier in use.

Impact

MDM enrollment of macOS VMs is a standard industry workflow (MDM vendors, admins, and CI all test management flows against Virtualization-framework guests, and PPPC/notification-settings payloads are honored only when MDM-delivered). On macOS 27 beta 4 a VM can enroll (Authenticate succeeds) but can never complete TokenUpdate, so no MDM can manage a macOS 27 VM. If BAA-backed client identity is intended to become mandatory for APNs, virtual machines need a supported path to satisfy it (e.g., via the host-SEP-derived VM identity introduced in macOS 15).

Questions

Is the BAA client-identity requirement for apsd courier connections intentional on macOS 27, and is the lack of a fallback in virtual machines a known issue?
Is there a sysdiagnose/feedback profile you'd like attached from the guest and/or host?

6.8 KiB Raw Blame History