Certificate lifecycle
Renewal
Certificates last 30 days. After two thirds of that, the device generates a new key pair and asks for a new certificate, authenticating with the one it still holds. Connhex Edge does this on its own. An image without the agent runs the same check on a timer of its own, covered under system image updates. A device that stays online never needs attention again.
Certificate TTL can be set to a different duration in Enterprise's instances
When a device misses the window
A device powered down long enough for its certificate to expire cannot renew, since renewal is authenticated by a valid certificate. It falls back to the enrollment credential it still holds and enrolls again. The same happens to a device that lost its stored credentials to a wiped partition or a factory reset.
Connhex has seen that serial before, so the request lands in the queue marked as a replacement. Approving it is deliberate: the same request is what a stolen credential would produce.
If you ship devices that sit in a warehouse for months, use per-device derived keys and set the profile's replacement policy to auto. Those keys name the device presenting them, so Connhex can tell a returning unit from an impostor without asking you.
Cutting a device off
Approving a replacement rotates everything the previous holder had: the certificate is revoked, the broker password is rotated, and any update token it held is reissued. The old unit stops working immediately, whether or not the replacement ever comes online.
To cut a device off without waiting for a replacement, delete it from Connhex.
Rotating a profile's claim key does none of this. It affects stock that has not yet enrolled, and nothing else.
When devices are not joining
Devices are told the same thing whatever the reason, so the answer is in Connhex, on the profile's Activity tab.
| What you see | What it means |
|---|---|
| Serial not on the allowlist | The profile is allowlist-only and this serial was not uploaded |
| Quota exhausted | The profile has admitted as many devices as it was allowed |
| Profile disabled | Enrollment is switched off for this profile |
| Replacement blocked | The serial has enrolled before, and the profile refuses replacements |
| Nothing at all | The key matched no profile. Check the token in the image, and whether it has been retired |
On the device, check the clock and the host it is calling. A device whose time is wrong cannot validate the server's certificate, and one built with the wrong domain never arrives.