i've always reencrypted when getting a new cert. not sure if thats an antipattern though. i just didn't want to be bothered by which cert encrypted what data