Expired encryption and Trust certificates

Question

Suppose:
a Mac OS X 10.8 server shut down for summer,
Linked to Active Directory Win Serv 2008 R2 x64,
Managing Macs and iDevices,
with an encription certificate expired early June 2013
and a Trust certificate expired late August 2013.
1- Do I read correctly that all Macs and iDevice (and Net Boot/Restore/install images) need to be reimaged with the New certificates?
2- Do I unedrstand also that all Update Server's Apple Updates need to be redownloaded. (just read that tonight).
3- What other thing to do in that case and in which order?
4- If nothing very important was done on that OS X server besides being linked to Active Directory and a few test Wikis., it it easier to rinstall from scratch?
==

Answer 1

I'd want a correct, current and valid certificate chain (and would likely set up a private CA, as is my wont), as bad certs can block some sorts of secure network access until either corrected or overridden, and as training the end-users to always "yeah, whatever" with certificate security can potentially lead to... well, other issues.
The software update server will certainly download new and updated changes, but shouldn't need to re-download everything.  Disk images will need to be updated.
I'd verify proper local DNS services and correct certs as part of the initial validation of the configuration, yes.
That's entirely your call.  Won't really help with the disk images, and will require a re-download of updates.