you can force a certificate update on the client by running netclient pull -n (have to include the network name a netclient pull with no network will not renew certs)