S/X: certificates and app connectivity — how to check

Quick FAQ

▸What are Tesla certificates and why do they matter?

These are TLS certificates — cryptographic keys the car uses to sign its connection to Tesla servers. Without them the Tesla App can't see the car, OTA updates don't arrive, and some cloud features (live map, weather, YouTube) stop working.

▸When do Tesla certificates expire?

Certificates live roughly 2 years from the car's build date or the last renewal. Owners can't configure this — the term is set by Tesla's PKI infrastructure, identical across Model S, X, 3 and Y.

▸How does Tesla auto-renew certificates?

100 days before expiry, whenever the car connects to a network, it sends a renewal request to Tesla's server. The server validates the current certificates and the account, then issues a fresh 2-year set. The key requirement: the car must be online at least once during that 100-day window. Tesla doesn't publish this window officially — the 100-day figure was determined empirically by the community and confirmed by several independent tests.

▸Can certificates be recovered after they've already expired?

If the cert chain is fully broken, you need work with Tesla's factory keys via Tesla Toolbox 3 with an online connection to Tesla's servers — available to service centers and independents with a Toolbox subscription — and Belarus has no official Tesla service. In practice that leaves independent workshops, and a full reflash with cert-chain restoration runs $1,500–3,000.

▸How do I check my Tesla's certificate status?

Two ways: 1) the certificate-expiry risk calculator on this site (/en/tools/cert-risk) — enter the car's build date; 2) Service Mode: Controls → Software → press and hold the MODEL wordmark for 2–5 seconds → enter the code 'service', then Infotainment → Connectivity — Tesla Connection status should be green. Red or yellow means a problem.

▸What should I do to keep certificates from dying?

Don't leave the car de-powered for more than a few weeks (especially within the ±100-day window around the 2-year anniversary of the build date), connect to home Wi-Fi when LTE is weak (renewals also go over Wi-Fi), and before any post-collision restoration first check the build date.