A branch edge with a valid certificate suddenly loses all control connections after an administrator revokes its certificate, and another edge warns of impending expiry. Which certificate lifecycle effect explains the revoked device losing fabric access immediately?

Revocation immediately invalidates fabric trust because controllers and peers validate certificates for every control session, so once an administrator marks a still-valid certificate as revoked they tear down existing tunnels rather than waiting for natural validity to lapse, which matches the sudden loss on one edge while a separate warning on another edge reflects the normal expiry monitor. The expiry-based reasoning fails by concept because expiration is time-driven with escalating warnings followed by teardown only after validity lapses, yet the affected device was described as holding a valid certificate that was administratively revoked. The renewal-based reasoning fails by concept because automated renewal presumes continued trust and orchestrates a planned rollover to a new identity with only brief interruption, whereas revocation expresses explicit distrust that blocks renewal and forces persistent isolation until remediation. The bootstrap reenrollment reasoning fails by concept because it describes an edge-initiated outage pending new key generation and approval, whereas the scenario is controller and peer-initiated teardown due to withdrawn trust that prevents reattachment. As an exam caveat, carefully separate revocation, impending-expiry warnings, renewal, and reenrollment timelines because stems often place a valid-but-revoked device alongside an expiring device to test whether loss is policy-driven or time-driven. As a practical check, confirm revocation entries and distribution status on the controllers, inspect logs for authentication or certificate-revoked failures, and separately validate expiration dates and warning thresholds on the remaining edges.