The FAQ link that's referenced in the first paragraph includes a statement about ZD's certificate refresh:
"ZoneDirector 9.13+ has the ability to report an AP certificate status and refresh AP certificate (for future SZ
migration), but does not require certificate check in order for APs to join."