I think this was the problem: "I have uploaded the original certificate created last year and Meraki seems happy as the certificate is now valid, but expires in 22 days."   Every year you need to renew the certificate, uploading the original or a new one would invalidate the connection between the device/MDM Platform (Meraki Systems Manager). But if you re-loaded the original and the devices still were connected, you might have got lucky...   See: https://documentation.meraki.com/SM/Device_Enrollment/Apple_MDM_Push_Certificate#Renewing_an_Apple_MDM_Push_Certificate   It may possibly be a Meraki SM bug that says it is valid for an additional year after uploading the original certificate, but this would be wrong. I am unsure if the certificate itself contains an expiry date... ... View more

If Safari was still locked from the device it most likely lost the ability to connect to WiFi and the profile could not update. Or, surprisingly, the profile got corrupted by some unknown force, rare... but it happens. ... View more