Agent does not connect to SSM (version 3.3.1611.0) after boot

[larsll]

When booting an OnPremise system, Ubuntu 22.04 + Raspberry Pi4, after having been offline for atleast 30 minutes I get the following error in the Agent log:

Agent version: 3.3.1611.0, (update: installed using the deb package)

2025-02-05 08:27:45.6674 INFO [ssm-agent-worker] Entering SSM Agent hibernate - InvalidSignatureException: Signature expired: 20250205T072745Z is now earlier than 20250205T075620Z (20250205T080120Z - 5 min.)
        status code: 400, request id: 5f020efe-47da-444d-ac8a-c86f767c7eda

Boot time was 20250205T080120Z, and it recognizes that the signature of the credentials have expired, but it does not request new ones.

Observations:

• Manually restarting with systemctl restart amazon-ssm-agent.service immediately resolves the problem, as it will collect new credentials.
• Waiting for 5+ minutes sometimes resolves the issue.
• The issue is not present if you directly reboot as the credentials are still valid.
• Rebooting a system where the agent did not connect after boot seems to resolve the issue.
• Issue observed on two devices (one a clean install of Agent, one being upgraded via SSM)

[larsll]

Additional observations:

• Snap based install (3.3.987) is also impacted, does not recover within 10 minutes, snap restart amazon-ssm-agent resolves the issue.
• DEB install (3.2.2143.0) on Raspberry Pi Zero/Raspbian equally.