How to properly renew enterprise iOS distribution certificate before expiration?

Question

I am currently 3 days from the expiration of 1 of my two allowed Apple Developer enterprise certificates; the provisioning profile for the app in question is also expiring on the same day. What I'm trying to figure out is what is the safest and cleanest way to renew the certificate, minimizing any time where existing builds would not be able to open or install from the Airwatch MDM catalog.

I have been able to find good information on AppStore certificates, in that it's totally fine if you revoke or allow the certificates to expire, the apps still continue to function, just no resigning of new versions. But the only relevant documentation I've been able to find mentions that on expiration, enterprise apps will stop functioning.

In the process of determining the best path, we did revoke our 2nd certificate and regenerated it - the revoke immediately broke the application that was using it and it was no longer able to be downloaded or opened. This causes us pause when considering revoking the 1st certificate prior to it expiring.

Any help would be amazing; sorry if this seems off-topic as I have seen marked on other questions on the topic.

Answer 1

[Updated after the profile replacement scenario ended up failing once the original cert and profile expired]

No great answers here (talked with Apple support for a while), but it actually worked fine.

Learnings:

Works: - Multiple computers can sign using the same cert via sharing the private key using export/import from keychain or xcode (could be used in scenarios where multiple teams need to sign for the same enterprise account)

Doesn't Work: - (what we tried, failed) Just uploading a new provisioning profile (based on a new/2nd cert) to existing apps in Airwatch (or other MDM or doing some of the re-sign, replace profile scripts that are out there) seems to keep them alive no problem. Then you can regenerate your expiring cert once the deadline passes, then resign back to the proper cert sometime in the 3 years until other cert expires