To replace the TLS certificate with a new one, use the CLI command:
weka security tls set
Once you issue a TLS certificate, it is used for connecting to the cluster (for the time it is issued), while the revocation is handled by the CA and propagating its revocation lists into the various clients.