replace keystore with newer certs