Just looked at the docs, it's apply and reboot which makes sense.

Oh, I forgot that you also have to manage the certs on the LOMs. Luckily browsers still allow you to bypass expired certs by default.

I wonder if you can still get into machines with the old SHA-1 stuff?

That's why serial consoles are better IMO.