The ApplicationConfiguration allows the change of ApplicationIdentity that mainly defines the content of certificates.
But it does not define what DNS and IP settings need to be inserted into a certificate. How is this configured?

Changes affect the certificates but 7.10.19 ApplicationIdentityDataType defines:
Applications shall continue to use the invalid Certificates which allows the configuration Client, which is aware of the mismatch, to complete the process needed to update Certificates.

How does a client create a new self-signed certificate if the server should continue to use a self-signed certificate?

Or maybe there should be one endpoint with CA signed and one with self-signed. I am not aware of a option to tell the server to create a new self-signed certificate.

We need more details on when to use the new information and how to trigger creation of new certificates.