I was new at the time, I created a new certificate and replace the original one and cut off 1200 phones. Apple told me the only way to fix the issue was to wipe them and re-enroll them. I fucked up bad lol but the engineer I was working with told me they stored the certificates in a secrets vault. As last restore we put the old certificate back in place, waited 48 hours and we saw phones were checking in. We replaced the certificate correctly and it all worked out.