Home / Troubleshooting / Troubleshooting guide
Cloud IoT

IoT certificate rotation failed

A device fleet cannot reconnect after a certificate expires or a rotation policy changes.

Applies to
  • AWS IoT Core
  • Azure IoT Hub
  • Huawei Cloud IoTDA
  • Other MQTT platforms
Last verified2026-10-10
Quick answerTroubleshooting · last verified 2026-10-10

A device fleet cannot reconnect after a certificate expires or a rotation policy changes. Most common cause to check first: Expired device certificate

Applies toAWS IoT Core, Azure IoT Hub, Huawei Cloud IoTDA
CategoryCloud IoT
Escalate whenAlways keep a documented rollback path. Never rotate the entire fleet before validating DNS, time sync, TLS and the provisioning workflow.
Last verified2026-10-10
How to cite this pageIoT Atlas. "IoT certificate rotation failed". https://hi-spark.net/troubleshooting/iot-certificate-rotation.html Last verified 2026-10-10.

Likely causes

  • Expired device certificate
  • Wrong CA chain
  • Clock skew on the device
  • Policy or thing registration mismatch
  • OTA rotation job failed

Quick checks

  • Check certificate validity dates
  • Confirm the device clock
  • Validate the CA chain
  • Compare device identity and policy in the cloud console
  • Test one pilot device before fleet rollout

Step-by-step fix

1

Identify the affected certificate and device group

2

Issue the replacement certificate

3

Test mutual TLS from one pilot device

4

Deploy rotation through a controlled OTA job

5

Monitor reconnect and error rates

6

Revoke the old certificate after the rollout