Hi @Tommaso Trevisiol,
We are aware of the Apple's Push Notification Service (APNS) server, you do not need to worry about this. Azure Notification Hubs will handle it for you, Microsoft keeps these certificates updated, so you can continue using our service without any interruption.
Microsoft generally maintains the trusted root certificates for Azure Notification Hub so, in general, you shouldn't have to do anything here manually. when Apple does an update to its certificate, then Microsoft will add it into the trust store.
As you are using the Certificate Authentication Mode you do not have to do anything.
Refer to the below link:
https://learn.microsoft.com/en-us/answers/questions/2157027/apple-push-notification-service-server-certificate?page=0&orderby=Helpful#answers
If the answer is helpful, please click Accept Answer and kindly upvote it so that other people who faces similar issue may get benefitted from it.