Tailscale silently expires device certificates: no warnings, no UI hints, only “it's a mistake”

What is the issue?

Tailscale silently allows Android device certificates to expire without notifying either the device owner or the tailnet admin. When the certificate expires, the Android client fails to authenticate and shows only the vague message “all we can know that it's a mistake”, without indicating the actual cause or suggesting where to look. This results in devices unexpectedly disappearing from the tailnet with no warnings, no logs, and no recovery guidance, making the system unreliable for any infrastructure use.

Steps to reproduce

1. Register an Android device in a tailnet and use it normally.
2. Wait until the device certificate approaches its expiration date. (No warnings or notifications are shown to the user or the tailnet admin.)
3. Allow the certificate to expire.
4. Open the Tailscale app on the Android device. The device appears disconnected, with no indication of the cause.
5. Attempt to log in again from the Android client.
6. Observe that the login fails with the message: “all we can know that it's a mistake” — with no explanation, no hint, and no recovery guidance.
7. Open the Tailscale admin console in a browser.
8. Notice that the device is marked as expired, which is not shown anywhere in the Android client.

Are there any recent changes that introduced the issue?

No. This does not appear to be caused by any recent client or server update.

The issue is reproducible even without changes to the Android app, the tailnet configuration, or the Tailscale backend. It seems to be a long‑standing behavior: Android device certificates can expire silently, without any warnings to the user or the tailnet admin, and the client does not surface the actual reason for the failure.

In other words, this is not a regression — it is a design gap in how certificate expiration is handled and communicated.

OS

Android

OS version

Android 15

Tailscale version

1.96.8

Other software

No response

Bug report

No response