What is the correct way to replace the certificate on a…

What is the correct way to replace the certificate on an existing vCenter Server that is part of a vCenter HA
configuration?

A.
Put the vCenter HA in Maintenance mode, replace the certificate, exit Maintenance mode.

B.
Shut down Passive and Witness nodes and replace the certificate on the Active node.

C.
Remove the Passive and Witness nodes, replace the certificate, reconfigure the cluster.

D.
Replace the certificate while all nodes are participating in the cluster.