Renewing Expired Samba DC Certificate

When It's first installed, Samba4 autogenerates self-signed certificate files(ca.pem, cert.pem, and key.pem). These files will be expired 700 days after creation. With the following procedure, the certificate can be renewed.

Suppose that the Domain Name is "example.lcl" and the fully qualified DC hostname is "sambadc.example.lcl".  I should also mention that the Linux Distro I'm using is CentOS 8.

First, create certificate files using the openssl command;

# openssl req -newkey rsa:2048 -keyout EXLCL-Key.pem -nodes -x509 -days 730 -out EXLCL-Cert.pem
    Generating a RSA private key
    .........................................+++++
    ...........................................+++++
    writing new private key to 'EXLCL-Key.pem' -----
    You are about to be asked to enter information that
    will be incorporated into your certificate request.
    What you are about to enter is what is called a
    Distinguished Name or a DN. There are quite a few
    fields but you can leave some blank For some fields
    there will be a default value, If you enter
    '.', the field will be left blank. -----

    Country Name (2 letter code) [AU]: TR
    State or Province Name (full name) [Some-State]: Istanbul
    Locality Name (eg, city) []: Istanbul
    Organization Name (eg, company) [Internet Widgits Pty Ltd]: Example Ltd.
    Organizational Unit Name (eg, section) []: Information Systems
    Common Name (e.g. server FQDN or YOUR name) []: sambadc.example.lcl
    Email Address []: admin@example.lcl

Copy certificate files to the location they should be;

    # cp -fp EXTLC-*.pem /usr/local/samba/private/tls/

And the smb.conf file should look like this (pay particular attention to the tls parameters);

# cat /etc/samba/smb.conf
  [global]
    log level = 1
    netbios name = SAMBADC
    realm = EXAMPLE.LCL
    server role = active directory domain controller
    server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbindd, ntp_signd, kcc, dnsupdate
    workgroup = EXAMPLE
    tls enabled = yes
    tls keyfile = tls/EXLCL-Key.pem
    tls certfile = tls/EXLCL-Cert.pem
    tls cafile =

  [netlogon]
    path = /usr/local/samba/var/locks/sysvol/example.lcl/scripts
    read only = No

  [sysvol]
    path = /usr/local/samba/var/locks/sysvol
    read only = No

Restart the Samba. Because I use systemd as the Service Manager;

# systemctl restart samba-ad-dc.service