Operational Certificate Rotation
Who should read these docs?
Firmware engineers implementing certificate expiration handling and rotation logic on the device.
Certificate rotation replaces an operational certificate that is no longer valid or trusted. There are several reasons this may happen:
- Expiry: Operational certificates have a fixed lifetime (currently 1 year). The device must check for approaching expiry on every boot and rotate before the certificate expires, or it will lose cloud connectivity.
- Compromise: If a private key is suspected to have been exposed, the device must replace its operational certificate immediately.
- Platform-initiated: The cloud may request rotation at any time and for any reason. For example, Milwaukee Tool operates its own intermediate Certificate Authority (CA) that issues device operational certificates. If that intermediate CA is rotated, all downstream device certificates must be replaced regardless of their individual expiry dates. The device must be able to receive and act on a rotation job at any point during normal operation, not only when expiry is approaching.
The bootstrap certificate authenticates the rotation request in all cases, following the same Fleet Provisioning flow as initial provisioning.
Certificate Lifecycle
The operational certificate moves through these states over its lifetime:
Rotation Paths
There are two ways rotation is triggered. The underlying provisioning flow (bootstrap connect → CSR → CreateCertificateFromCSR → RegisterThing → reconnect with new cert) is identical in both cases.
| Path | Trigger | Details |
|---|---|---|
| Device-triggered | Device detects expiry approaching, unexpected disconnect, or potential compromise | The device initiates rotation autonomously |
| Platform-triggered | Cloud issues an AWS IoT Job targeting the device | The device discovers the job, performs rotation, and reports the outcome back via the Jobs API |
The bootstrap certificate must be kept permanently in secure storage. It is the only credential that can authenticate a rotation request.
Bootstrap certificates are issued with a long lifetime and are not subject to the same rotation cycle as operational certificates. They are designed to outlive the device. However, if a bootstrap certificate is ever revoked (e.g. due to compromise), the device cannot recover remotely. In that case, physical access is required for re-provisioning.