Skip to main content
Version: 10.7.1

Single Registration Certificate Renewal

Certificate Renewal​

HYPR Passwordless authentication uses Active Directory certificates bound to trusted user devices to enable secure, phishing-resistant authentication. As these user login certificates approach expiration, renewal is required to ensure continuous authentication, maintain security posture, and comply with organizational and regulatory requirements.

HYPR Workstation Agent starts notifying the user via system tray 30 days before expiration that a pending renewal awaits and the login certificate on the mobile device can be renewed automatically.

Certificate Renewal - Workstation to Web​

No new deployments

CBA Workstation-to-Web Single Registration is supported for existing deployments, maintenance only, until August 1, 2027. HYPR no longer enables it for new deployments, and works with affected customers on a transition plan. You can still register users for web authentication and workstation authentication separately.

Flow Description​

  • HYPR Workstation Agent detects an upcoming current login certificate expiration.

  • The agent will request a new certificate for the user.

  • The New Certificate is generated and saved locally.

  • The agent waits for the next Unlock request.

  • During the next unlock session using the HYPR Mobile App, the new certificate is transferred to the HYPR Mobile App through the HYPR Server.

  • The subsequent unlock events using the HYPR Mobile App will use the new certificate to establish the login session.

  • The agent marks the certificate renewal successfully completed, runs certain bookkeeping operations and continues the authentication workflow.

Facts​

  • Login certificate renewal is initiated by the HYPR Workstation Agent process running on the employee's laptop, which contacts AD CS to enroll a new certificate.

  • Users must be connected to the corporate network (domain/VPN) for the certificate renewal to succeed and complete.

  • The user will receive warnings from the system tray when a certificate must be renewed.

    a. 30 days before expiration to alert the user - Snooze option is available

    b. 7 days before expiration to actively request the user to complete their renewal

    c. 1 day before expiration - Snooze option is not available

  • The new certificate will sit on the Workstation local file system until there is an opportunity to send it to Mobile, which happens during an unlock request initiated by the Mobile App and flows through the HYPR Server.

  • If the new certificate is enrolled and successfully transferred to Mobile App and comes back to Workstation, the very first time, Windows will contact Active Directory to authenticate that certificate, but after success, Windows will cache this certificate.

  • Workstation - connected to corporate network (domain/VPN)

    a. After renewal, first unlock successful

    b. New certificate is used

    c. Mobile App is indicated that new certificate is all set

  • Workstation - not connected to corporate network (domain/VPN)

    a. After renewal, first unlock not successful

    b. Current certificate is used

    c. Pop-up notification to the user to connect to VPN and unlock.

  • Mobile App

    a. Keeps track of two certificates, current and new one.

    b. Sends both certificates during the Unlock request.

    c. Waits for acknowledgment when the new certificate is accepted.

Pre-Requisites​

  1. HYPR Server is in a running state

    a. Workstation To Web feature flags are enabled.

  2. Mobile App has workstation registration.

  3. The user workstation is connected to the domain.

Configuration​

  1. Enable Auto Enrollment Feature Flag

    a. MOBILE_AUTO_CERT_RENEWAL

Testing the Workflow​

To test certificate renewal for Workstation-to-Web Single Registration:

  1. Test workstation unlock for workstation registrations by making the current certificate in a state where it is close to expiration.
  2. Test workstation unlock for workstation registrations when the current certificate is in expired state.
  3. Test workstation unlock by making the workstation connected to the corporate network (domain/VPN).
  4. Test workstation unlock by making the workstation not connected to the corporate network (domain/VPN).