I was concerned about that expired certificate using the full installer as well. I submitted a TICKET #21206638403. We first tried to just uninstall the Device Services (DS) using the full installer and modifying the existing installation per their documentation and that failed. We ended up using the Programs & Features control panel to completely uninstall Workspace One UEM from the DS server. I suppose we could also have used the newer Apps & features Setting to do the uninstall too. When not installed at all the installation went through completely without error and the newer SSL certificate was then used so AWCM was working again. We also applied the same patch upgrade to match the other servers at the time (.19). We had to disable the Windows Defender firewall to allow domain network connections to port 2001 as well.