Answer
It's the same mechanism as any other middle-tier configuration change — running the installer (mtinstaller) reconciles the running environment to match whatever is currently in ifscloud-values.yaml and solutionset.yaml, so updating the certificate path/password in that YAML file (or passing them as installer command-line parameters) and rerunning the installer is all that's needed; there's no separate certificate-only procedure distinct from a normal configuration-change installer run.