Cisco ISE "deployment trust"

Hey fellow networkers,

does anybody know which certificates are used to establish the trust in an ISE deployment? I just renewed the "admin usage" certs on two Administration Nodes because the selfsigned certs are running out in a few days.

My guess is, that the initial trust between the nodes was made with the said selfsigned certificates - because I had to install the certs across the ISE nodes before I was able to join them. Will the new certificates from now on be used in the trust deployment? Or is it more like a "trust an ISE node once and forever, I don't care about certificates anymore"? Or is there a mechanism which is independant of (installable) certificates because a hidden trust is established?

Thanks in advance