Long time no see...

I get this error in ZCC when accessing the Certficates tab in the Configuration section. The zcc.log records a java.lang.NullPointerException.
We have two 2017 primaries on SLES 11sp4 that have used the same internal CA for years. I deployed 2017 Update 1 on them the other day and I think that was when this happened. I did not notice it until I tried to add another primary server to the zone, it kept saying that neither of the old primaries had the CA role.
In the Certificates tab in ZCC all CA buttons are greyed out and only one of the servers shows in the ZENworks Server SSL Certificates pane, the one not having the CA role.
Is there any way to make ZENworks find the CA again? Help much appreciated!