Hi Julius,
correct, when you upgrade the CryptoLib, you need to create new PSE's and by creating new PSE's you will invalidate all certificates which you have shared with satellite systems, therefore, the certificates need to be distributed again to satellite systems.
Best regards,
Andy.