Kokkie deployment of a new Auth certificate takes a couple of hours. So, you should give the deployment process some time.
I'd recommend replacing the certificate as outlined here: https://docs.microsoft.com/en-us/exchange/troubleshoot/administration/cannot-access-owa-or-ecp-if-oauth-expired. After that, wait a couple of hours (if you have the time, just kick of the process to replace the certificate a day before installing the update). Then install the Security Update and run the PrepareSchema command.
Published Jul 19, 2021
Version 1.0