In the past this worked to reset certificate settings and fallback to self-signed cert:
config show pki #just to know current settings
config setprop pki CrtFile ''
config setprop pki KeyFile ''
config setprop pki ChainFile ''
signal-event certificate-update