any time I have to refresh our trusted certificate used for STARTTLS, ... I have to call the support, because the GUI simply confirms the updated certificate, although the old certificate is still being used. Barracuda Support and Development know about such problems.
Please get it done. The goal should be a way to update the certificate without any downtime in SMTPS availability. Right know, not even that is possible without engaging the Support.