What is the proper form for "cert_identifier" when using "certupdate"?
The certupdate tool was not really intended to be used manually, it is supposed to be called by a process that watches the System keychain. 

The cert identifier is made up of three parts separated by the ':' char they are:      hashtype:hash:"subject"

sha256:0fa41022930ef3d200102d4f0a90e53b250674b9:"my server.com"

The hash portion is the hashtype hash of the DER formatted certificate.

you can get the identifier for the certificates of interest by running the server admin command:
sudo serveradmin settings certs

and looking for the identifier key associated with each cert returned.