when smime certs age out

[IamtheStefan]

Hi all, we're using Zimbra NE 8.8.10 and I have to handle s/mime certs within webclient.
The smime zimlet is enabled. I can import a cert on 'Preferences' -> 'Secure Email'. It is working fine.
I wonder about a cert ages out. Under 'Secure Email' I have the only options to 'view' or 'remove' the old cert. No button to import a new cert. But I want to put in the new cert beside the old cert. I need to keep the old cert in order to read old mails encrypted with the old cert.
Didn't find any information about the smime cert process over time (1. import a cert, 2. cert ages out, 3. import a new cert 2 weeks before the old certs end, 4. import a third cert, 5. ...)
Can anybody help please?

Stefan