Please help me understand and solve this problem.


  1. Let's start with an IoT design. When it is working correctly, a remote device has a pem certificate which is used to validate traffic to and from the server, which has holds the matching certificate. While the certificate is not expired, it works perfectly.

  2. Now let's say that the device certificate expires. It will no longer work. However, if the expiry check is removed from the code running at the server end, it works again.

  3. While a device with an expired certificate will work fine as in (2), it is impossible to register an already expired certificate to the server.


I want to allow another device to communicate with this server. I do not have physical access to the device, but I do have the certificates which are loaded onto it. It holds expired certificates but as per (2) above, this isn't actually a problem. The issue is that I cannot register the expired certificate (3). If I could it would work perfectly. Is there a way in which I can alter the validity of the certificate such that I can register it, and it will still be compatible with the certificate on the device? Remember, it is impossible to access the device, so I can't change the certificate on that.

Please be kind while answering this question. It's asked in good faith.

1 Answer 1


While it is not possible to "extend" a X.509 certificate, it is possible to issue a new certificate to the same public key.

From there, it should be trivial to devise a scheme for the IoT device to request a new certificate when it is close to expiration. In theory, you could even trust a certificate that has already expired.

The IoT device will need some kind of writeable storage to store the certificate.

If you have no capabilities of ever updating any data on the device, the best you can do is issue a certificate that lasts far longer than the expected lifespan of the device, e.g. until 2999.

  • So, it sounds like the answer to my question is no. There is no way to restore communication to a device subject to the constraints I've outlined. That's very helpful.
    – monkey
    Oct 19, 2023 at 20:08
  • @monkey You can ignore the certificate validation timespan on the server
    – Sergej
    Oct 19, 2023 at 22:45
  • Yes, that's what I'm doing in assumption 2. The problem I'm trying to solve is that I can't register a new (already expired) certificate.
    – monkey
    Oct 20, 2023 at 2:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .