Meanwhile I filed the bug report:
My solution proposal is
- remove the restart of cockpit-ws, to avoid the session cut off
- display a warning, trying to explain that to prevent disconnection the new certificate is applied to cockpit itself 90 seconds after all sessions are closed.