IMPORTANT UPDATE: Since I have taken the repository offline, the steps outlined below no long work when trying to access the nimble and inject binaries from Cydia. I have provided a zip file download (with instructions on how to install the binaries) before the struck out text.
This post is for people who can’t get a push certificate via Push Doctor (the instructions are in an earlier post but hard to find).
You will need another jailbroken iOS device that can activate via iTunes for this to work. iPod touch and iPad will do fine (otherwise you need an iPhone that can legitimately be activated). For the sake of this guide, since I am personally able to activate legitimately, I will be using one device to demonstrate.
First, disable any passcode locks on both devices (as well as any SIM pins if applicable). Without this you will have to restore the secondary device.
Install OpenSSH on both your hacktivated iPhone and the second iOS device (and change your password, google the instructions for that, this way you protect yourself).
Download the zip file here.
In Cydia, add http://cmdshft.ipwn.me/apt/ as a new repository on both devices and let it refresh.

When that completes, install “nimble” on the device that is activated via iTunes, and install “inject” on the hacktivated device.


Open up a terminal (Terminal.app or PuTTY), log into the device that can activate with iTunes over SSH and run:
su [root password required]
cd /private/var/Keychains
./nimble

This will generate 4 .bin files in the Keychains directory. These are your certs, store them in a safe and secure location using an SFTP capable program (FileZilla, Transmit, Cyberduck, etc).

Using your SFTP program, login to the hacktivated iPhone, put those .bin files in /private/var/Keychains as in the screenshot above, open an SSH connection to this device and run:
su [root password required]
cd /private/var/Keychains
./inject

Shut down the hacktivated iPhone.
Login to the device that activates with iTunes via a terminal and run:
su [root password required]
rm -rf /var/root/Library/Lockdown
killall -TERM lockdownd SpringBoard

A connect to iTunes image/emergency call screen will show up, simply reconnect this device to iTunes and it will reactivate and can be used right away.

You can now turn on the hacktivated iPhone and push should work just fine.
You can use this method to backup your push certs (they are unique), which you should do anyway, this way any time you have to restore and rejailbreak you don’t have to rely on Push Doctor in case there are no certs on the server.