You first replace the certificate in Region A. As the protected region, it contains the main management components of the SDDC.