Apple Push Notification Service certificates expiring

If you run an OS X Server and get notified that the APNS certificates are expiring, don't try to renew them from Server->Certificates or the ASNS Identity website.  Push Certs are easily created and renewed from Server-><server name>->Settings and clicking "Edit.." for Enable Apple push notifications.  From there it is one click to create or renew the set of Push Certs.

Counterintuitively, these certificates don't show up under Server->Certificates, although you can view and delete from the System keychain.  Unlike other Certificate renewals, there's no link in the notification that the certs are expiring, and I'm writing this in hope that I remember where to renew them next year.