The lcg-CAs on the following machines are updated automatically via yum, though it pays to double check:
lcgmon01
ceprod0[3-6]
gfe02
gfe03 (UI)
lfc00
wms01
wms02
wmslb01
wmslb02

They are not necessary on the bdiis.

They need to be updated by hand for the tarball installs:
on the lx machines /vols/grid/glite/certificates
on lt2install /vols/grid/certificates (this will get copied to /vols/grid/glite/certificates over night)
UI and WN share the same certificates directory. To update, tar up an updated certificates file e.g. on the CE, remove the old certificates directory on /vols/grid (SAM tests don't like obsolete certs etc) and copy the new one in its place.