feat: replace SSL certs in routes in-place

Confluence example generating CSRs without regenerating private keys.
https://apps.nrs.gov.bc.ca/int/confluence/display/ALCS/Certificate+Renewal#CertificateRenewal-GenerateaCertificateSigningRequest(CSR)