I have a cassandra cluster where each node has a self-signed certificate generated by keytool. The certificates were generated around the same time and all expired recently. Internode SSL communication appears unaffected, but some clients (including cqlsh with the default settings) refuse to connect.
How do I properly update, renew, or replace these certificates without causing downtime or otherwise breaking things? I am thinking of issues like "okay, I just replaced it, but none of the other nodes trust the new cert yet so now bad things happen."
