The TSO ACF command processor can be used to change a certificate's label, the ACTIVE date**, the Expire date** or the TRUST status.
** Note The ACTIVE date and EXPIRE date are different from the Certificate's the certificate validaity dates. The ACTIVE and EXPIRE dates must be within the certificate's validaity dates. The certificate validaity dates are shown on the CHKCERT display output as 'Not valid before:' and 'Not valid after:' after dates.
The syntax of the CHANGE command to change the LABEL of a certificate is change recid newlabel(label).
For example: ACFSET PROFILE(USER) DIV(CERTDATA)CHANGE USER01.CERT NEWLABEL(IBMWebServerSYS1)
Details can be found in the CA ACF2 for z/OS Administration Guide, Chapter 3: Maintaining Logonid Records, section 'Changing CERTDATA Profile Records'.
Thanks for sharing this, Michael_Blaha