@filister I dont know your usecase, but it sounds like you could try to replace the certificates by hand, and thus get a successful switch to your then hopefully working config.