Automate X.509 certificate rotation across an IoT device fleet before expiry

Steps

1. Inventory certificate expiry dates by querying your PKI or cloud IoT registry; for AWS IoT use AWS IoT Device Defender's DEVICE_CERTIFICATE_EXPIRING_CHECK audit, which flags certificates expiring within a configurable window
2. Issue new certificates from the same CA hierarchy before old ones expire; for AWS IoT, use CreateCertificateFromCsr so the device generates the private key locally and submits only a CSR — the private key never leaves the device
3. Deliver the new certificate to the device via a secure channel: publish it to a protected MQTT topic, use a device twin desired property, or include it in a signed OTA bundle; verify the device has written the cert to persistent storage before proceeding
4. Have the device connect once using the new certificate while the old certificate is still active to verify the new credentials work; only deactivate the old certificate after a successful test connection
5. Automate the deactivation and deletion of expired or rotated certificates using IoT Defender Mitigation Actions or a scheduled Lambda/Function that calls the cloud API; keep an audit log of all certificate lifecycle events
6. For fleet-scale rotation, stagger renewals across device cohorts to avoid a thundering-herd reconnect storm; use device twin tags or groups to schedule rotation waves over days or weeks