Certificates

Before you can send push notifications via Pushy (or any other APNs provider), you'll need a certificate to authenticate with with APNs gateway. Apple provides detailed instructions for provisioning a certificate, but there are some caveats.

In particular, Apple's docs say:

3. Find the certificate you want to export and disclose its contents.
   You’ll see both a certificate and a private key.

4. Select both the certificate and the key, and choose File > Export Items.

This appears to be slightly incorrect, at least under Mac OS X 10.11 (El Capitan). Selecting both the certificate and key appears to generate a PKCS#12 file that contains the certificate and two copies of the private key. Selecting only the certificate results in a PKCS#12 file that contains only the certificate, but selecting only the key creates a PKCS#12 file with both the certificate and a single copy of the private key (which is the desired outcome).

If even that doesn't work, try 'sanitizing' the .p12 returned from the keychain with the following commands:

openssl pkcs12 -in apns_certs_from_keychain.p12 -out apns_cert.pem -clcerts -nokeys
openssl pkcs12 -in apns_certs_from_keychain.p12 -out apns_key.pem -nocerts -nodes
openssl pkcs12 -export -inkey apns_key.pem -in apns_cert.pem -out apns_all.p12