Certificate rotation and restore tabletop

Work through certificate renewal and restoration on paper. Identify owners, dependencies and recovery steps for expiry and broken trust relationships.

Sources and scopeSource record 25 August 2026

Technical source record: 25 August 2026. Check the linked documentation for current product requirements.

Offline research and planning only; product or deployment acceptance belongs to separately governed environment validation.

Verification and testing

Overview#

Lab class: Tabletop

Scenario#

A management service issuing CA will expire in 30 days. Cameras, controllers, gateways, brokers and operator clients trust it through different deployment mechanisms. A recent backup contains the old trust state, and several field devices can be updated only through a gateway.

Discussion sequence#

1. Inventory every certificate, trust anchor, service name, client and owner.
2. Identify firmware/client limitations and whether dual trust/overlap is supported.
3. Establish trustworthy time and alerting.
4. Define issuance, key generation/storage and approval for the replacement chain.
5. Sequence trust anchor distribution before leaf replacement without creating an unintended broader trust set.
6. Define validation evidence, hold points and rollback at each cohort.
7. Determine how restored backups avoid reinstating expired or compromised trust.
8. Plan emergency revocation/distrust and temporarily disconnected assets.
9. Define safe service behaviour when validation fails; reject plaintext/accept all fallback.

Outputs#

Produce a certificate inventory, dependency graph, cohort sequence, overlap window, monitoring plan, rollback plan, backup reconciliation rule, ownership map, and separately governed environment validation cases.

Review checklist#

• Certificate, service name, trust anchor, client, owner, and expiry inventory completed
• Dual trust, firmware/client limitations, time dependency, and cohort constraints mapped
• Key generation/storage, issuance approval, trust distribution, and leaf replacement sequenced
• Hold points, monitoring evidence, rollback, and emergency distrust/revocation decisions assigned
• Backup restoration can't silently reinstate expired or compromised trust
• Validation failure rejects plaintext, accept all, and unapproved bypass behaviour
• Physical or operational certificate acceptance cases routed outside the tabletop

Sources#

• RFC 5280, accessed 25 August 2026.

Related pages#

• PKI, certificates, keys, and secrets
• Resilience, backup, and recovery

Section overview · Wiki home