A fleet of devices has certificates expiring in two years. What must be true today for that not to be an incident?

What is being tested

Whether you treat credential renewal as a system that must be exercised rather than as a future task.

What must be true today

1. Renewal works, and has been demonstrated on real devices in the field. Not "the code exists" — devices have actually renewed, and you have the telemetry to prove it.

A renewal path that has never run has an even chance of being broken, and discovering that at expiry — on devices you cannot physically reach — is unrecoverable.

2. Renewal starts long before expiry. Weeks or months of margin, so a device offline for an extended period still has time when it reconnects. Renewing at 90% of lifetime leaves no room for a device that is dark for a month.

3. It handles the long-offline case. A device that has been disconnected for months must be able to renew when it returns. If renewal requires a still-valid certificate and the certificate has expired, the device is locked out permanently.

4. Renewal failures are visible. Per-device telemetry on certificate age and renewal status, with alerting on the tail — because the fleet-wide average will look fine while a subset is stuck.

5. A recovery path exists for devices that fail to renew — a bootstrap mechanism, a manual re-enrolment, or a fallback credential. Otherwise the failure is terminal.

The related properties a fleet needs

Per-device credentials, never shared. A shared secret means one compromise between an attacker and everything, and it cannot be rotated without touching every device.

Hardware-backed keys where physical access is in the threat model, so a key cannot be extracted and cloned.

Least privilege per device — a sensor should publish its own telemetry and nothing else, so one compromise is bounded.

Revocation that works for devices checking in rarely. Short-lived credentials with regular renewal are usually more practical than revocation lists, because they fail closed by default.

Identity separable from the physical unit, so a repaired or swapped device keeps its logical identity and data history.

The decision made before manufacture

Provisioning — how a device gets its first credential — determines everything after it, and the options close once hardware ships.