Tesla certificates: what they are and how to restore them once expired (2026)

What Tesla certificates are

Every Tesla receives a set of TLS certificates at manufacture: cryptographic keys that sign the communication between the car and Tesla's servers.

There are three certificates, not one: one on the MCU and two on Autopilot (A and B). They renew independently of one another, and it is an entirely normal situation for the MCU certificate to have renewed while the Autopilot ones have not (#506415, #499135, #506357).

Without live certificates:

• the Tesla App cannot see the car;
• OTA updates do not arrive: the firmware currently installed will stay on the car forever (#505328, #505330);
• some cloud features (live map, weather, YouTube) do not work;
• the car stops going to sleep and drains charge; more on this in the symptoms section.

Certificates live for about 2 years from the car's build date or from the last renewal. The owner cannot configure this: the term is set by Tesla's PKI infrastructure, which is the same for Model S, X, 3 and Y.

Myth: certificates arrive over Wi-Fi together with the firmware

The most persistent misconception on the subject: that certificates are only checked when an update is downloaded, so “you have to connect the car to Wi-Fi once every two years”. The chat took it apart twice in a single week.

It is wrong on three counts:

1. The updater and the certificate renewal service are different services and are not connected to each other (#455960, #455963);
2. A certificate weighs a couple of kilobytes and arrives over the SIM; the car simply needs to be online, by any means (#455965, #456102);
3. Wi-Fi is needed for the multi-gigabyte firmware and maps.

The counter-argument the chat uses to close the debate: if certificates only arrived over Wi-Fi, half the Teslas in Russia and the USA would have been driving without certificates long ago (#456081, #456104).

The 100-day rule

The community's working rule: certificates should renew themselves roughly 100 days before the end of their term, provided the car was connected the whole time (#499128, #506071).

How it works:

1. About 100 days before expiry the car, while online, sends a request to Tesla's server;
2. The server checks the validity of the current certificates and of the account;
3. If everything is in order, it issues a new set for the next 2 years.

Tesla does not publish the auto-renewal window officially; the 100-day figure was derived empirically by the community and confirmed by several independent tests.

The main diagnostic sign: if the deadline is close and no renewal has happened, the car was standing offline during the critical window. The typical Belarusian case: months in a container and at a temporary storage warehouse (#499132). When assessing an imported car, the chat budgets “a month before the auction and two after” as the period when the car was guaranteed to have been without a connection (#476933).

A live breakdown from the chat: a 2021 car with a production date of 14.01.2021 should have received a renewal before 28 June, while its last sync was in December 2025 (#475077, #475078).

How to check in a minute

The “Software” tab

If the certificates are alive, the “Software” section on the car's screen prints the Autopilot type and the connection type. No lines means no certificates (#460822, #460823).

Service Mode → Connections

1. Controls → Software → hold the MODEL lettering for 2–5 seconds → enter the code “service”;
2. Open the Connectivity / Connections section;
3. Give the car Wi-Fi and look at the status: green means the link to Tesla is there (#465655, #465592).

This is a mandatory item when inspecting a freshly imported salvage car.

Two limitations of this check:

• a green Connectivity tab does not guarantee that updates will arrive: on some cars it is green while the updates never come (#506460, #506461, #506463);
• a green tab does not cover the Autopilot certificates (see the next section).

If the airbags went off on a salvage car, you cannot get into Service Mode at all until the body controller is cleared: it will load forever (#476898, #476901).

The calculator on this site

The certificate expiry risk calculator will show, from the build date, the current cycle, when the last renewal window was and the risk that it did not go through. A caveat: on HW3/AP3 cars the calendar calculation does not work: there you have to read the certificate issue date directly (#484597).

Exact dates from a laptop

Exact validity periods are read from a laptop connected to the diagnostic port: MCU on https://192.168.90.100:8081, Autopilot on the same port at 192.168.90.103 and 192.168.90.105 (#506415, #484570, #499139). On Model 3/Y the connector is on the right, where the wiring harness is, under the trim; on Highland there is no RJ45 any more, it is OBD2 under the steering wheel (#484575). People advise running the cable behind the trim once and leaving it there; access is then always at hand (#484585).

Autopilot certificates live separately

The MCU and Autopilot certificates renew independently, and a green Connectivity tab in Service Mode does not cover the Autopilot ones (#506424, #506425, #506432).

The typical symptom: the firmware downloads onto the MCU and stalls at the stage of pushing it to Autopilot. The car sees the update, starts pulling it and never finishes installing (#465600, #465601, #489139). A case from the chat: a 2022 MY LRDM, the main certificate renewed in May 2025, the Autopilot ones dead: firmware 2026.20.6.1 is picked up and never installs (#476938, #476946).

A corollary for inspecting a salvage car: the fact that the car started downloading an update does not prove the certificates are alive (#476902). Only firmware that actually installed proves that (#499118).

A case that is reason enough to check yourself: at a specialist shop, during paid diagnostics, an owner was told the certs were alive. Only the main one was alive; the Autopilot ones were dead, and meanwhile the car had stopped going to sleep and was eating 5–10% overnight (#487085). Ask them to look at all three (#499135).

An import specialist's observation: on 9 out of 10 cars arriving with dead Autopilot certificates, the Software tab shows EU maps that were loaded not over the air but from a laptop via the console (#506348). The causal link is disputed in the chat: a salvage title and time spent sitting in a container may be to blame (#506412).

Symptoms of dead certificates

• The app cannot see the car or works with gaps: climate and the charging schedule do not work, even while you are sitting in the car (#489145).
• Firmware does not install: it does not arrive at all (the main certificate is dead) or it downloads and stalls (the Autopilot ones are dead).
• The car stops going to sleep and drains charge: it goes into an endless loop of attempts to reach the servers. Figures from the chat: a 2018 M3P with no certificates since 2023 lost 30% in 5 days in a car park with Wi-Fi off and Sentry disarmed (#455253, #454805, #454807); another, 5–10% overnight (#487085); a third, 10% per day until the process reset itself (#465603, #465621). The chat considers about 1% (1–2 km) overnight to be normal (#455262).
• Wi-Fi sees networks but does not connect: on entering the password it thinks for a long time and writes “unable to connect”. One case: a Model S 90D from 03.2016, last updated in 2024 in America (#453477, #453478). Separate the budgets immediately: as of September 2026 a stuck firmware update is about $100, dead certificates are thousands (#453481).

What restoration costs (September 2026)

A year ago $3000 was the standard figure. Over the past few months the price has fallen by a factor of 2–3, but this is not a stable trend: in the chat what is happening is called a window that rests on a specific channel inside Tesla and may close (#499045, #496859, #507584).

The summary pinned in the chat at the end of September gives a wider range than the $1000 quoted in conversation. The sum depends on the model, the car's condition and how complicated the case is: complicated cases there include restrictions imposed by service centres, Black List and Unsupported statuses, and cars after failed attempts. The exact cost, and whether restoration is possible at all, is only named after a VIN check.

Remotely through @Adessit16, a partner of the site, restoration costs $1100 to $1500. How the formats and methods differ is covered in the next section.

About this pricing:

• An Autopilot certificate costs the same as a connectivity certificate; it is not a free extra (#494091).
• Brest operators undercut the Minsk ones (#494092).
• There is no point going to Bucharest to save money: a trip to the official service centre comes out at roughly the same price, only with a visa and the journey itself on top (#475071). It is, however, the most above-board of the three restoration methods, covered in the next section.
• Nearby official service centres are cheaper on the invoice, if you can actually get there: Vilnius restored the connectivity and Autopilot certificates on an American 2016 Model S with a replaced MCU and AP3.0 and did the recall work as well, €53 in total (#500755, #500761, #500927). Warsaw in August 2026 restored the Autopilot certificates and loaded the latest firmware for 2,400 zł (~€600) and 2 days; an American car on Belarusian plates was no obstacle (#487054, #487055, #487089).

Booking a Warsaw appointment, from someone who went through it: via the Tesla app, the problem described in correct Polish, a linked Polish bank card (someone else's is fine), a reply within 10 days, book for a Tuesday or Wednesday because Saturday and Sunday are their days off and you would have to pay for a hotel. After that the instructions come through the app (#487085, #487087, #487103, #487105).

How it is done and why the channel is unstable

The main work happens on Tesla's side: open access for the specific VIN, allow a connection without a certificate and push a new one (#453305, #453295, #453299). How much the owner does in the meantime depends on the format of the work (more on that below): sometimes it is enough to give the car internet on command, sometimes you have to work on the car by hand following instructions.

Only Tesla's certificate authority and the people with access to it can issue and push a certificate. This is not a backyard-garage service, by the same logic that a digital signature for the tax office cannot be issued by garage guys (#494138, #494123). Hence the properties of this market:

• there is a limited number of operators, despite “fixers having multiplied” (#452859);
• the service rests on a specific employee at an official service centre: if they are fired, restoration temporarily stops (#494125);
• the scheme works in waves: working today, not tomorrow, and you cannot plan around it on a six-month horizon (#482455, #489432).

Three methods and their risks

The summary pinned in the chat (September 2026) divides restoration into three methods. The method determines whether updates and maps will keep arriving afterwards, so find out which one it is before paying.

1. Official Tesla service centre in Romania. The most above-board option: the car physically arrives at the service centre and goes through all the required tests on camera, the work is done officially, and payment goes through the owner's Tesla app. Such cars are not accepted there just like that; the booking is arranged by a middleman. The community does not yet have a verified contact for such a middleman. With the visa and the journey, the cost comes out at roughly the same as restoring at home (#475071).
2. The American channel. Restoration goes through a channel in the USA, and the main risk is that Tesla notices it and shuts it down. That has happened many times already, and restoration prices shot up to $3000 each time. Even so, certificates already issued were never revoked and no cars were blacklisted.
3. The “Ukrainian” scheme. The certificates are restored through Tesla support by claiming that the car is in Ukraine. When Tesla sees that the car is not there, the VIN gets blacklisted, permanently as far as is known; details are in the section on the main risk below. An operator's method can change, so ask about it before every deal, even with an operator you have used before.

Remote or turnkey

The format of the work determines how you pay and how much you have to do yourself.

Remote restoration is done by @Adessit16. He works through the American channel directly, without middlemen, so he comes out cheaper than the rest: $1100 to $1500 and 1 to 2 business days. He names the exact price, and whether restoration is possible at all, after a VIN check. Two conditions are worth knowing in advance: he only takes US-market cars and works with prepayment. The car stays with you, you receive instructions and carry out all the steps in the car yourself, including disconnecting cables. If the car is not from the US or you are not prepared to do the steps in the car yourself, turnkey operators with payment on completion are listed in the services directory.

On request @Adessit16 adds a year of Premium Connectivity to the restoration for +$100 with no markup: the subscription is taken out officially and linked to the VIN (more in Tesla Premium Connectivity in Belarus).

The chat also tells three options apart by who ends up with the money, each with its own price/accountability trade-off (#504185):

1. Through an official service centre: the most expensive once travel is counted, but you get a warranty and paperwork;
2. Through a middleman in Belarus: takes cash, transfers crypto to the operator; there is someone to hold responsible;
3. Straight to a service-centre employee for USDT: the cheapest, but there is nobody to complain to.

For the procedure you send documents proving ownership (#458148).

The main risk: the scheme via a complaint to support

There is a “cheap” restoration scheme going around the market, via a complaint to Tesla support with the cover story “the car is in Ukraine, we cannot get it to a service centre”, sometimes with Ukrainian documents and a spoofed geolocation. It is cheaper than normal restoration, and that is exactly why it gets offered. The September pinned summary in the chat describes it as the “Ukrainian” scheme.

What happens next: Tesla sees from the SIM and GPS that the car is not in Ukraine and puts a flag on the VIN, a software update blacklist. It is permanent (#507130, #507258).

The consequences:

• updates stop arriving over the air: the firmware has to be pushed by hand at a shop (#507261, #507263);
• the maps get tied to the Ukrainian region and stop arriving: on cars after such a restoration they freeze at version 2019.20 and never move on (#507100), and some cars are left with outdated European maps;
• at the next certificate expiry restoring them is next to impossible;
• the flags are visible on a VIN check: the report for such a car shows “Ukraine List Manually” and “Software update – Blocked”. A second-hand buyer will see this.

Personal messages from owners of such cars have already started arriving in the chat: the car does not update automatically, you have to drive in and get a push done at a shop (#507266, #507600).

The saving here is one-off, the flag is forever. If an operator offers restoration “via Ukraine” or asks for Ukrainian documents, walk away.

Be careful with middlemen

A case from the September pinned summary in the chat: a middleman from Lutsk charged $800 per restoration, did not pass the money on to the operator on time and covered the cash gap with payments from new clients. In the end he cheated many owners.

A price well below the market combined with an unfamiliar middleman is a reason to be wary. As of September 2026 the market sits in the $1000 to $1500 range, and $800 falls well outside it; with prepayment the whole risk lands on the owner.

What to clarify before paying

Before paying an operator or a middleman, find out:

1. Which method will be used for the restoration and what that means for updates and maps.
2. The timeline and payment terms: prepayment or on completion.
3. What happens if the restoration fails or the car gets blocked later.

Public reviews: timelines and how the work goes

Three independent reviews from summer 2026, in every case remote, with no travel needed (#452836, #458139, #468232):

• 3 days. The owner had been driving without certificates for almost 2 years. The car stayed with him the whole time; all that was required of him was to supply internet on command (#452836, #453296).
• 3 business days. A 2021 Model Y; the car had lived in Belarus for a year without certificates; before that the owner had spammed every Tesla address and approached various specialists (#458139, #458146, #458156).
• 4 days from the start of work to full restoration, with no trip to Europe (#468232).

In September two more reviews appeared: the certificates, including the Autopilot ones, were restored remotely in under a day, after which the car updated and immediately pulled in the maps (#507569, #507600).

After restoration the car is visible in the app again (#462473, #462479). How long they have been dead is not a blocker: they have been restored even after two years without certificates (#455253).

What happens after restoration

• FSD may be taken away. In one of the cases the owner had FSD removed along with the restoration (#468243, #468246).
• Supercharger does not come back. Supercharger access removed from salvage American cars is a story separate from the certificates. Without a physical visit to a service centre in the USA it cannot be restored legitimately; cases where “a couple of chargers worked” are bugs, and the access gets taken away again (#504755, #504756, #504760, #504763).
• EU maps may roll back. A case from 08.06: the car had 2025 EU maps, and after the update they rolled back to 2019. It did not prevent the restoration and the maps were later returned, but some operators refuse outright when the car is in that state (#458148, #458157).
• There is no guarantee the certificates will not be taken back. The scheme is wave-like, and the question “can they blacklist it later” has no firm answer in the chat (#482455). Experience with the American channel is encouraging so far: Tesla has closed it many times but has never revoked certificates issued through it or blacklisted those cars. After the “Ukrainian” scheme, by contrast, a blacklist is to be expected; see the section on the main risk.

Linking to the app: what changed by autumn 2026

Restoring the certificates is half the job: the car still has to be added to an account. And here, as of 20 September 2026, things have got noticeably worse.

• Tesla verifies documents in every case (the registration certificate and the driving licence) and looks at whether they come from the matching country. “Cat photos” and random addresses no longer get through.
• The “buy Premium Connectivity from a middleman” scheme is dead. The fixers who did premium for 200 BYN have scattered, and nobody is promising premium in that form to anyone now. There is no one to chase for money paid up front: the middleman simply disappears. If someone promises you “lifetime” premium for a fixed sum today, assume it is a scam. The one-year subscription for +$100, which @Adessit16 adds to the restoration officially and linked to the VIN, is not part of this scheme.

Details on the subscription itself are in Tesla Premium Connectivity in Belarus; bear in mind that the “via a middleman” option described there is an opportunity that has already closed.

A free workaround while you are without the app: b-key for tesla controls the car over Bluetooth (climate, lights, windows, doors, horn); you can add a car to it even without certificates (#466753, #466828, #466832). It does not replace the full app or remote climate outside Bluetooth range (#494095, #494082).

What it costs on resale

As of September 2026 missing certificates mean $1,500–2,500 off the price immediately, and some buyers simply refuse to talk (#493189, #493192, #494109).

An example from the chat: a 2023 Model 3 Performance without certificates for $26,500 (#493194). Buyers complain that half the listings on av.by are without certificates at $25–28k, and the listing does not state the fact (#507310).

Hence the conclusion for the “buy a car without certificates on the cheap” calculation: the price difference is often smaller than the cost of restoration, and the restoration itself is not guaranteed (#489432). On top of that, the duty-free EV import quotas in Belarus have run out: as of September 2026 customs clearance means 15% duty, plus another 20% VAT on top for cars older than 5 years.

Checking the certificates is a mandatory inspection item: see buying a salvage Tesla from Copart. When buying a Tesla second-hand, also check whether software updates arrive, which maps are installed and how they were installed: frozen updates and outdated European maps can be a trace of the “Ukrainian” scheme and its blacklist. If in doubt, ask a certificate operator to check the car before you buy. The general inspection procedure is in the used Tesla buying checklist.

Do not confuse: salvage certificate ≠ connectivity certificates

A common buyer confusion, reinforced by AI assistants: a salvage certificate from an auction is a document about the car's status (an analogue of a registration certificate; there is no direct equivalent in Belarus). It has nothing to do with Tesla's https connectivity certificates (#486700, #486702, #486703).

A car with a salvage title may have perfectly live certificates, and conversely a car that is clean on paper may arrive without them.

Prevention

• Keep a physical SIM in the car, even without premium: certificates only renew on a car that is permanently online (#499785, #500065). The side benefits are remote climate, charging monitoring, an up-to-date route with traffic and fast wake-up (#500064, #505349).
• Do not leave the car offline for months, especially in the 100-day window before the second anniversary of the build date or of the last renewal.
• When importing, count the months sitting in a container and at the temporary storage warehouse as time without a connection, and check the certificates on arrival rather than six months later.
• Before repairing after a crash, check the build date: if the window is close, certificates first, everything else after.

On SIMs and modem bands: Modem and bands: USA vs Europe. Replacement and SIM. On manual firmware updates: Firmware and forced updates over SIM.

Links

• Certificate expiry risk calculator
• The app cannot see the car: diagnostic checklist
• Buying a salvage Tesla from Copart
• What to check when buying a used Tesla: checklist
• Tesla Premium Connectivity in Belarus
• Directory of services and shops
• A case of expired certificates after a long offline period: https://www.teslaownersonline.com/threads/tesla-model-y-certificate-reset-issue-after-extended-offline-period.34199/
• Official Service Mode guide (PDF): https://service.tesla.com/docs/Public/ServiceMode/service_mode_user_guide.pdf
• Cases of being unable to log in / link: https://www.reddit.com/r/TeslaLounge/comments/1i02ztd/login_necessary_to_enable_1gb_data_plan/
• Official: LTE retrofit after the 3G shutdown: https://www.tesla.com/support/3g-cellular-network-retirement

Discussion on Telegram: #455960, #499128, #507130, #507261, #506415, #499045, #494085, #452836, #458139, #468232, #493189, #499785