A logistics firm replaced its PKI and several WAN Edge routers show control connections flapping after a root CA rollover, with one branch certificate past expiry and another listed on the CRL. Controllers remain reachable and clocks are correct. Which action addresses the certificate states that keep these two edges from holding control connections?

Control connections require DTLS/TLS authentication where each edge presents a leaf chaining to the trusted root with valid dates and clean revocation status, so a past-expiry certificate and a CRL-listed certificate both fail verification and block peering even with reachable controllers and correct clocks, requiring renewal of the expired identity and replacement of the revoked identity. Reinstalling the new root chain after rollover is standard for anchor trust, but it fails by concept because path validation still rejects an invalid leaf despite a correct anchor. Redistributing controller addresses and re-initiating DTLS suits transport flaps, but it fails because repeated handshakes cannot succeed when authentication fails closed on certificate state. Using SCEP enrollment for devices approaching expiry is valid prevention, but it fails because it handles future expiry only and does not cure an already revoked identity needing a new certificate. As an exam caveat, do not conflate root rollover with leaf validity and do not treat correct clocks as proof of validity, since skew is eliminated but expiry and revocation remain. As a practical check, display edge certificate dates and issuer, confirm chain to the new root, check serials against the CRL or OCSP, install renewed certificates, then verify stable control.