Bring endpoints back from storage

An endpoint that was turned off for months, such as a spare laptop in a cupboard or a computer used only one season a year, reconnects on its own when you turn it on, even though its agent certificate expired while it was off. This page explains when Outpost accepts an expired certificate, how to change or turn off the grace period, and how to see which endpoints came back.

How returning endpoints reconnect

The agent authenticates to your Outpost with a certificate that is valid for 90 days. The agent renews it automatically 30 days before it expires, so a computer that is on regularly never sees it expire. A computer that is off for longer than its certificate has left, which can be as little as 30 days, comes back with an expired certificate.

Your Outpost still accepts an expired certificate for a grace period after it expired, 18 months by default, as long as nothing else is wrong with it. On its first check-in, the agent gets a new certificate. The endpoint then catches up as usual: it installs any agent update, and receives patches and policy on its normal schedule.

This works on Windows, Linux, macOS, FreeBSD, and OpenBSD, and needs no agent update.

An expired certificate is refused when any of these is true:

• The certificate was revoked.
• The endpoint was retired.
• The endpoint has a newer certificate. The older one keeps working for 7 days after the newer one was issued, so an agent whose renewal was cut off can try again.
• The certificate was issued for a different client.
• The certificate expired longer ago than the grace period.

A refused endpoint cannot reconnect. Enroll it again. See Bring a computer back.

Caution

A lost, stolen, or discarded computer that was never retired can reconnect within the grace period. Retire every endpoint you dispose of, because retiring revokes its certificate. For a client that needs stricter control, set the grace period to 0.

Before you begin

• Changing the grace period needs the client:manage permission. Reading it needs client:read. See Roles and permissions.
• Pioneer AI and connected MCP clients can read the grace period but never change it.

Change the grace period

The grace period is set per client, on the Returning devices card. Where the card is depends on your console:

• On the MSP plan, for a client: in Clients, select Record on the client’s row. The card is on the client’s record.
• On the MSP plan, for your own practice’s endpoints: Settings > Security policy.
• On every other plan: Settings > Security policy.

To change it:

1. On the Returning devices card, choose how long the grace period is:
   • Use the default (18 months) follows the Outpost default.
   • Set a number of months sets your own.
2. If you chose Set a number of months, enter a whole number from 0 to 36 in Months after the certificate expires. 0 turns the grace period off.
3. Select Save.

In effect now shows the grace period that applies, or off. The change applies to the next connection from any endpoint of that client. The change is recorded in the audit log as organization.agent_cert_grace_updated, with the value before and after.

See which endpoints came back

When an endpoint checks in after more than 30 days offline, Outpost records it in three places.

An alert. An info alert in the Offline category, titled Endpoint back after 212 days offline: followed by the endpoint’s name. Its detail gives the date the endpoint was last seen and, when the grace period was used, the date its certificate expired. An info alert notifies nobody unless an alert rule includes info alerts. It resolves as Aged out without clearing 7 days after it was raised. An endpoint whose monitoring.agent_offline_alert_minutes policy setting is 0 raises no alert. See Alerts.

The endpoint’s Overview. For 30 days, the Status card on the endpoint’s Overview tab shows a Returned row after Last seen, with the date it came back and how long it was offline. When the grace period was used, the row ends with certificate renewed under the expired-certificate grace, or certificate renewal pending until the agent has its new certificate. See Endpoint details.

The audit log. In Settings > Audit logs, on Console actions:

Action	When it is written
endpoint.returned	The endpoint checked in after more than 30 days offline. Records when it was last seen, how many days it was offline, and whether the grace period was used.
endpoint.cert.grace_accepted	The endpoint connected with an expired certificate under the grace period. Records the certificate’s expiry date, the grace period, and the date the grace period ends.
cert.renew	The agent renewed its certificate. After an expired certificate, the entry also records the previous certificate’s expiry date.

See Audit log.

Verify

After you turn on a computer that was in storage, wait for it to check in, then open the endpoint. Last seen is a moment ago, and the Returned row reads certificate renewed under the expired-certificate grace.

If the endpoint does not come back, see Troubleshoot the agent.

Set the grace period through the API

GET /api/v1/organization/agent-cert-grace reads the grace period and PUT changes it. On the MSP plan, address a client with /api/v1/clients/<client-id>/organization/agent-cert-grace. The request body must contain graceMonths: a whole number from 0 to 36, or null for the default.

{ "graceMonths": 6 }

The response also carries effectiveGraceMonths, defaultGraceMonths, and maxGraceMonths. A value out of range, or a body without graceMonths, is refused with status 422. See the Depot REST API.

Related

• The Outpost agent
• Retire or uninstall the agent
• Agent and tray updates
• Alerts