A new certificate can be issued before the existing certificate expires. This makes it possible for the encrypted communication to continue seamlessly. As soon as a new certificate is available on the controller parallel to the one currently used, the new certificate will be offered by the controller at the next login attempt. All you have to do is accept it.