title: What is the best workflow for an IoT client to receive the new PEM certificate when the old one expires?
body: <p>I'm setting up an Ubuntu machine to work as an MQTT server. It is a MOSQUITTO server. The clients of this server are based on the ESP32 microcontroller (ESPRESSIF). (I'm using the ESP-IDF framework.)</p>
  <p>The server is using SSL transport. So each client must have the server's PEM certificate. The problem is that this certificate has an expiration date. So, I still don't understand how, in practice, clients will receive the new PEM certificate when the current one expires.</p>
  <p>Can anyone point me to a practical workflow on how to grant the new certificate to all clients?</p>
  <p>Regards</p>