You only need to do this on the active FI, not both, no.

That would be correct

Since you haven't done anything to the cert since installation, all you need to do is regenerate the default key ring.Refer to this document, under "Regenerating the Default Keyring":http://www.cisco.com/en/US/docs/unified_computing/ucs/sw/cli/config...