This article details the steps if you need to create and replace an old or expired certificate with a new Master Certificate or Recovery Certificate.
Attached screen shot is from SEE 8.0.0. But it is same on any GERS or SEE environment as well.
Go to GPOE > Software Settings > SEE Removable Storage Encryption > Recovery Certificate:
Any GERS or SEE RS Environment
Master Certificate based deployment
Certificate Authority (MSCA, Symantec, Entrust, etc)