[ovirt-users] Bad libvirt-spice certificate - regenerate?

I have an oVirt 4.1 cluster that was initially installed with 3.5 in 2014. The SSL certificates on the physical hosts in /etc/pki/vdsm/libvirt-spice have a problem - the "not before" date is invalid (it doesn't include a time zone), and so I can't connect to VM consoles from a client with OpenSSL 1.1.0i (up to date Fedora 27). How can I regenerate these certificates? Also, I noticed they expire next year - is that expiration handled automatically? -- Chris Adams <cma(a)cmadams.net&gt;