Need more details.  Are these WM or Android?  What is the network authentication mechanism?  EAP-TLS?  Are you doing mutual authentication or just server side (are your clients configured to validate the EAP server)?  You are using terms that have multiple meanings depending on context.  I assume you are always using "profiles" in the Fusion profile context, not the MC profile context, correct?  You say they are not "connecting" anymore.  Not connecting to the MC server or not even connecting to wireless?  If wireless, do you have the device side fusion client logs?  What do they indicate?  I assume you are using a RADIUS server to authenticate the device certs.  What is in the server logs?  What do you mean by "support" profile?  Do you have a special SSID that devices can use a "support" profile to connect?  If the devices are now disconnected, what mechanism are you imagining that you would use to reconfigure these devices?  Just need some clarification.