To replace certificates for the Global Manager cluster, you import root and intermediate CA-signed certificates as appropriate and replace the Global Manager default certificates with the imported certificates using API calls.