Certificate upgrades: 2026

As part of updates to the Ardexa Cloud, we have implemented a new Ardexa Root Certificate Authority and several enhancements to the digital certificates our devices use to connect to the cloud and encrypt communications. These changes mean that all devices will need to be updated with new certificates by June 30 to maintain connection to the cloud.

To help manage this process, we have added several new icons and features to the Ardexa Cloud application.

What needs to happen

By June 30, every device needs to have a new certificate reissued. This will be managed by several processes:

• Ardexa will upgrade online devices automatically. This should account for the vast majority of devices on the cloud

• Ardexa will coordinate with customers to upgrade devices that are intermittently online

• Devices that are persistently offline will need to be brought online by the customer

• Devices that are old, broken or otherwise no longer required to connect to the cloud will be identified by customers and excluded from the upgrade procedure

Which devices need to be upgraded?

The Devices page has been updated to show devices that need further action as part of this migration.

Devices that have been migrated will have no additional icons

Devices that need a certificate upgrade will have a "refresh" icon displayed next to their name:

Devices with an unknown certificate status will have a question mark icon displayed next to their name: These devices will typically have been offline for several weeks or more.

New filters (Updated Certificate, Old certificate and Excluded from certificate migration) have been added to the Devices page to display devices in each state:

What do I need to do?

During this migration, Ardexa will periodically upgrade certificates on all online devices that have not already been upgraded. This should handle the vast majority of devices.

Your Ardexa Account Manager will be in touch to coordinate upgrades of devices that require manual intervention.

Manual upgrades

Devices that are intermittently online, or have been specifically brought online can be updated manually by using the 'Reissue certificate' function on the Devices page:

After selecting the menu item, select the "Immediately deploy the updated certificate to the device" option and click "Deploy":

Once this has completed successfully, wait for two minutes, then select the "Check certificate status" option for the device.

This will confirm that the certificate on the device has been updated successfully, and update the status of the device in the cloud. If successful, the refresh icon next to the device's name should disappear.

Note: switching a device off within two minutes of a certificate update can result in the original certificate being restored by Ardexa's fallback safety mechanisms. It is strongly recommended that you wait two minutes after updating the certificate to check the status and power down the device to eliminate this possibility.

Not doing this could result in the device being unable to connect to the Ardexa cloud if it is reconnected after June 30.

Excluding obsolete devices

Old, obsolete or broken devices will appear as Offline, with an unknown certificate status. If these devices will never need to connect to the Ardexa Cloud again, they can be excluded from the certificate migration process by selecting the "Exclude from certificate migration" menu item:

This will help focus resources and attention on devices that need to be updated.

If a device is excluded from the migration by mistake, you can undo this by selecting the "Include in certificate migration" menu item:

What happens after the deadline?

Devices that have not had a certificate update will not be able to connect to the Ardexa Cloud.

Ardexa Cloud connectivity at a site can be restored by either:

1. Manually reinstalling a new certificate on the device

2. Arranging a replacement device with Ardexa

Manually installing a new certificate

Devices can be recovered by manually deploying an updated certificate to the device. To do this you will need a way to access the machine outside of the Ardexa Cloud. The options here are:

1. Physically connecting a keyboard, monitor and USB stick to the machine

2. Using alternative remote management software that allows interaction with the machine with file transfers and command execution

To access the machine locally you will need the username and password for ArdexaLinux. These can be obtained from your Ardexa Account Manager.

Procedure

This procedure assumes that you have physical access to the device, and that ArdexaLinux is installed. The exact commands required may vary slightly.

1. Reissue the device's certificate via the Devices page, and select the "Download a certificate pack containing the updated certificate" option. The certificate pack will be downloaded as a zip file.

2. Transfer the certificate pack zip file to a USB stick

3. Connect keyboard, monitor and USB stick to the device and log on to the local OS

4. Mount the USB stick:

   1. Identify the device name by running lsblk. This should list a device name such as /dev/sdb, with a partition of /dev/sdb1

   2. Create a mount point: sudo mkdir -p /mnt/usb

   3. Mount the USB stick: sudo mount /dev/sdb1 /mnt/usb

   4. Verify successful mount by running ls /mnt/usb

5. Copy the certificate pack zip: cp /mnt/usb/certpack.zip /etc/ardexa/keys/

6. Unzip the certificate pack:

   1. cd /etc/ardexa/keys

   2. unzip certpack.zip. This should extract the following files:

7. Restart the agent, by running systemctl restart ardexa.service

After this, the device should reconnect to the cloud, assuming no other issues are preventing connectivity. Refer to other knowledge base articles for troubleshooting advice.

Finally, unmount the USB stick by running sudo umount /mnt/usb and remove the USB stick and other accessories.

Arranging a replacement device with Ardexa

Please discuss this option with your Ardexa Account Manager to determine the best approach.