Direct answer
Identify the certificate's purpose, device and issuer, monitor its validity and renewal status, and verify the dependent authentication workflow before and after replacement.
Map certificate dependencies
Record the device, certificate purpose, issuer, validity dates and owner for services such as managed network access. Avoid exporting private keys or placing certificate secrets in tickets. Identify which management profile or issuing service is responsible for renewal.
Investigate renewal status
Compare the device's installed certificate with the management report, issuance logs and current time. Microsoft documents certificate monitoring and SCEP delivery checks for supported Intune deployments. An expired certificate and a delayed report call for different follow-up.
Reference: Microsoft: Monitor issued PKI certificates.
Test replacement safely
Coordinate a renewal or replacement with the certificate and service owners, using the approved change and rollback process. Verify the new certificate's intended use and a representative network or application connection. Track offline devices and remove obsolete certificates only after dependencies are understood.
Example: wireless authentication renewal
Before a device certificate used for corporate wireless expires, confirm the correct issuer, renewal assignment and device check-in with the network team. Pilot renewal on a test machine and verify it can reconnect to the intended network. Keep an alternate support route because an incorrect certificate change can interrupt management connectivity.
Assessment limits
Certificate policies and renewal behavior vary by issuer, platform and enrollment method. A valid date alone does not prove that authentication or private-key protection works.
Frequently asked questions
Does a valid certificate date prove access works?
No. Test the intended authentication path and verify the correct certificate and private key are available.
Should private keys be copied into a support ticket?
No. Use approved key management and provide only nonsecret identifiers and restricted evidence.
Can an offline device miss renewal?
Yes. Check its management connectivity and the renewal process for that certificate type.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.