Renew Certificate for all clients

Now have many of our IBM Storage Protect Server been running for years and it is time to renew our certificate especially our self-signed version that many of our installations has been configured with. In the 8.1.20 Server version is it now possible to renew our certificate but the deployment to all our clients hasn't been fixed yet. 

But there is a issue with Storage Protect main design here where we can only use 1 certificate to be trusted, there for if we renew it on our server side we need at the same time renew it at the same day for all our clients manually. 

An idea is to have 1 Primary Certificate that is our preferred certificate and a Secondary Certificate that is a fall-back, in that way if we renew the certificate on the server side and make it as our primary certificate the clients that need to be renewed will then failed to communicate and it get's another chance to signin again with a backup certificate that could be the old certificate, and if that works Storage Protect Server will then push the Public Key for the Primary Certificate and then ask the client to relogin with the Primary Certificate, if that is successfully then can the client backup/restore or any other functions. 

This idea is very similar to the Transitional mode that we have today, but in this case you must already have a valid certificate that still are the backup certificate valid time period. 
If the client miss that transformation period, then should we go back to as it works today that you need to either change the node back to Transitional mode or manually add the certificate to the GSK Trust store.