Single Registration Certificate Renewal

Certificate Renewal

HYPR Passwordless authentication uses Active Directory certificates bound to trusted user devices to enable secure, phishing-resistant authentication. As these user login certificates approach expiration, renewal is required to ensure continuous authentication, maintain security posture, and comply with organizational and regulatory requirements.

HYPR Workstation Agent starts notifying the user via system tray 30 days before expiration that a pending renewal awaits and the login certificate on the mobile device can be renewed automatically.

Certificate Renewal - Workstation to Web

No new deployments

CBA Workstation-to-Web Single Registration is supported for existing deployments, maintenance only, until August 1, 2027. HYPR no longer enables it for new deployments, and works with affected customers on a transition plan. You can still register users for web authentication and workstation authentication separately.

Certificate renewal in the Workstation-to-Web Single Registration flow follows the standard certificate-renewal path for HYPR Passwordless workstation certificates. The canonical procedures live in:

• Certificate Renewal (HYPR Mobile App) — renewal when the device is the HYPR Mobile App.
• Certificate Renewal (Security Key) — renewal when the device is a hardware security key.

Single Reg-specific nuances

• Workstation-to-Web Single Reg keeps the workstation certificate as the authoritative credential. Renewal happens on the workstation side; the web profile picks up the renewed credential automatically through the linked Single Reg pairing.
• The Mobile Automatic Certificate Renewal capability governs auto-renewal behavior — confirm its state with HYPR Support before relying on auto-renewal for production deployments.
• If a workstation certificate expires before renewal completes, the user can still authenticate via Recovery PIN (if Recovery Mode is enabled in Workstation Settings) to re-establish access.

Testing the Workflow

To test certificate renewal for Workstation-to-Web Single Registration:

1. Test workstation unlock for workstation registrations by making the current certificate in a state where it is close to expiration.
2. Test workstation unlock for workstation registrations when the current certificate is in expired state.
3. Test workstation unlock by making the workstation connected to the corporate network (domain/VPN).
4. Test workstation unlock by making the workstation not connected to the corporate network (domain/VPN).