I currently have a 8.7 SP2 P2 version.

I'd like to replace SSL Self-Signed Certificate with trusted (from internal CA). I found the procedure:

https://community.rsa.com/s/article/ERR-SSL-PROTOCOL-ERROR-when-accessing-RSA-Authentication-Manager-Security-and-Operations-Consoles-with-Google-Chrome-117-and-higher

but I have a questions:

The procedure only talks about Operation Console certyficate (tcp443). Will other services use it too? (tcp5555, 7002, 7004, 7022 etc). Maybe there is a separate procedure for replacing cert in other services?

Will I have to replace it again after the next upgrade (e.g. patch 3)? Is the certificate permanent and will not be overwritten by the next upgrades?