When updating the certificates for Compliance Event Manager, does CEM need to be re-started on each LPAR or just select ones?
You will need to re-start CEM on each LPAR that requires the new certificate. This is the only way to pick up the certificate change if not using AT-TLS.
If using AT-TLS, only an AT-TLS policy refresh is required in order to pick up changes to a keyring and certificates.