A long time ago on a BaaS platform I worked on, we dealt with an IoT company that pinned certs and when we rotated them they had no way of updating their devices... I think we had to put them on their own server and just left the old cert running forever. As the sibling comment here says, "I doubt a random IoT company does stuff the proper way..."