>1. The device doesn't have a battery, so when it boots it thinks the time is Jan 1, 1970. X.509 wasn't even invented at that point so there are no valid certificates for that date.
Defaulting to date of manufacture instead of unix timestamp 0 would get you closer, although it's still not a solution.
You could also periodically store time in a non volatile memory, to be loaded on boot.
Right, but Let's Encrypt certificates are only valid for 90 days. And there's loads of electronics in the world that's been powered off for more than 90 days :)
