Sometimes the access to the APNS certificate or Apple account containing the original apns certificate is lost.
In this case there is no other option but to replace the APNS certificate with a new one.
Xenmobile device manager has a built in tool which reruns the APNS part of the installation. This tool is called iosenabled.cmd which can be found in the root of the xenmobile device manager root dir.
The following steps need to be taken
Create a certificate request for the new apns certificate
Submit this .csr to Citrix
Submit the .plist file to the apple account.
Download the .pem file from the apple account.
Complete the certificate request using the .pem file.
Export the certificate .pfx format and write down the export password.
Start a CMD as administrator
Start iosenabled.cmd browse to the .pfx
Enter the password.
Enter the portnumber and FQDN.
Leave the other default settings.
The new APNS certificate is now in place.
It will however require a re-enroll of the devices using the old apns certificate.