I ran into this bug recently. Upgraded a UCM 11.5 cluster to UCM 14 SU2. The upgrade went smoothly and the certificates migrated normally. This bug came into play when the tomcat certificate was recycled. The existing tomcat certificate was signed...