Can't connect to apple push notify server for production
<p>My push notification script was working until i renewed expired certificates and upload a new apk. I checked everything, my certificates and provisions look correct and push notification service is enabled. Also, it works with development certificate on sandbox. </p>

<p>When i use production certificate, i got error and nothing i found on the internet did not help. Here is the code:</p>

<pre><code>&lt;?php

$deviceToken = '1b66005d6ee0e58eac581a29dce21c34083a3560d3a097b8224ce99412c7a5c5';
$message = 'test!';

$ctx = stream_context_create();
stream_context_set_option($ctx, 'ssl', 'cafile', 'apple_ca.pem'); // entrust ca certificate
stream_context_set_option($ctx, 'ssl', 'local_cert', 'apn-dist.pem'); // my certificate

// Open a connection to the APNS server
$fp = stream_socket_client(
    'ssl://gateway.push.apple.com:2195', $err,
    $errstr, 60, STREAM_CLIENT_CONNECT|STREAM_CLIENT_PERSISTENT, $ctx);

if(!$fp) exit("Failed to connect: $err $errstr" . PHP_EOL);

echo 'Connected to APNS' . PHP_EOL;
// sending notification ...
</code></pre>

<p>Above code dumps this error:</p>

<pre><code>PHP Warning:  stream_socket_client(): Failed to enable crypto in test.php on line 14
PHP Warning:  stream_socket_client(): unable to connect to ssl://gateway.push.apple.com:2195 (Unknown error) in test.php on line 14
Failed to connect: 0
</code></pre>

<p>When i test my certificate like this:</p>

<pre><code> openssl s_client -connect gateway.push.apple.com:2195 -cert apn-dist.pem -debug -showcerts -CAfile apple_ca.pem
</code></pre>

<p>It is successful:</p>

<pre><code>New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : AES256-SHA
    Session-ID:
    Session-ID-ctx:
    Master-Key: 5E9F3C0A551D6A487***********
    Key-Arg   : None
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1458680158
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
</code></pre>

<p>It was working in the past with the previous certificate (also without ca file).</p>