Firewall disconnecting from Panorama

I had a PA220 that was off being shipped around the world for a few months. Long enough that the device cert expired. When it was powered back on it didn't reconnect to Panorama by itself. I went ahead and renewed the cert on the device directly, that didn't seem to make a difference. Then I followed the process to recover managed device connectivity (sc3 reset, clear the status on the panorama, new authkey), that connects it back to Panorama for a bit but then it gets disconnected again after a few hours.

In configd.log on the Panorama side I see this:

2022-07-07 08:14:45.248 -0500 SC3: did:'<serial>', ser:'<serial>', ver:'10.1.6-h3', mod:'PA-220'
2022-07-07 08:14:45.249 -0500 Warning:  sc3_register(sc3_register.c:211): SC3: connstat for '<serial>': -1
2022-07-07 08:14:45.249 -0500 Warning:  sc3_register(sc3_register.c:248): SC3: register device '<serial>' does not have a peer cert.
2022-07-07 08:14:45.249 -0500 Error:  sc3_register(sc3_register.c:255): SC3: Re-register of '<serial>' is not allowed.
2022-07-07 08:14:45.249 -0500 Warning:  _register_ext_validation(pan_cfg_mgt_handler.c:4410): reg: device '<serial>' not using issued cert.

I'm going to reach out to support but with their response times lately I figured I'd ask here too in case anybody has run across this. Both the Panorama and PA-220 are at 10.1.6-h3.

Thanks!