Skip to main content
Version: 11.3.0

Single Registration Certificate Renewal

Certificate Renewal​

HYPR Passwordless authentication uses Active Directory certificates bound to trusted user devices to enable secure, phishing-resistant authentication. As these user login certificates approach expiration, renewal is required to ensure continuous authentication, maintain security posture, and comply with organizational and regulatory requirements.

HYPR Workstation Agent starts notifying the user via system tray 30 days before expiration that a pending renewal awaits and the login certificate on the mobile device can be renewed automatically.

Certificate Renewal - Workstation to Web​

Certificate renewal in the Workstation-to-Web Single Registration flow follows the standard certificate-renewal path for HYPR Passwordless workstation certificates. The canonical procedures live in:

Single Reg-specific nuances​

  • Workstation-to-Web Single Reg keeps the workstation certificate as the authoritative credential. Renewal happens on the workstation side; the web profile picks up the renewed credential automatically through the linked Single Reg pairing.
  • The feature flag MOBILE_AUTO_CERT_RENEWAL (or its Single Reg counterpart) governs auto-renewal behavior — confirm the flag state with HYPR Support before relying on auto-renewal for production deployments.
  • If a workstation certificate expires before renewal completes, the user can still authenticate via Recovery PIN (if Recovery Mode is enabled in Workstation Settings) to re-establish access.

Certificate Renewal - Web to Workstation​

Certificate renewal in the Web-to-Workstation Single Registration flow uses the Certificate Enrollment Service to issue a renewed user certificate. The canonical procedure lives in the same renewal docs as Workstation-to-Web:

Single Reg-specific nuances​

  • Web-to-Workstation renewal requires the Enrollment Service to be online and reachable; if the service is unavailable during renewal, the workstation profile reverts to using the existing (soon-to-expire) certificate until the next attempt.
  • The HYPR Certificate Enrollment Service must have a current Enrollment Agent certificate at renewal time.
  • Same MOBILE_AUTO_CERT_RENEWAL flag controls automation; verify with HYPR Support.

Testing the Workflow​

  1. HYPR CC Console can be used to create a magic link for the web application.

    a. Enter the user's email in the Username field. This is the same email address that is associated with the user profile on Active Directory.

    b. Click Create Magic Link

  2. The user navigates to the Magic Link Web Link URL, which redirects the user to device manager.

  3. The user selects 'Register mobile device' that makes a call to HYPR Server to initiate the web registration.

  4. Wait a few minutes for the server to process the certificate

  5. The user taps on the Pending Computer bubble.

  6. The user scans the QR code on the Windows lock screen to complete the WFA pairing.

  7. Cert Renewal

    a. Test workstation unlock for workstation registrations by making the current certificate in a state where it is close to expiration.

    b. Test workstation unlock for workstation registrations when the current certificate is in expired state.

    c. Test workstation unlock by making the workstation connected to the corporate network (domain/VPN).

    d. Test workstation unlock by making the workstation not connected to the corporate network (domain/VPN).

    e. Test workstation unlock for web registrations when the current certificate is in a state where it is close to expiration.

    f. Test workstation unlock for web registrations when the current certificate is in expired state.