once. Only watn recently (3 months) active users. Regenerate unencrypted certificates before the expire.