diff --git a/app/src/main/java/org/matrix/TEESimulator/config/ConfigurationManager.kt b/app/src/main/java/org/matrix/TEESimulator/config/ConfigurationManager.kt
index 3b5f84a..7ad7038 100644
--- a/app/src/main/java/org/matrix/TEESimulator/config/ConfigurationManager.kt
+++ b/app/src/main/java/org/matrix/TEESimulator/config/ConfigurationManager.kt
@@ -247,14 +247,20 @@ object ConfigurationManager {
             when (path) {
                 TARGET_PACKAGES_FILE -> loadTargetPackages(file!!)
                 PATCH_LEVEL_FILE -> loadPatchLevelConfig(file!!)
-                // Any change to an XML file is assumed to be a keybox. The cache in KeyBoxUtils
-                // will handle reloading it on its next use.
+                // Any change to an XML file is assumed to be a keybox.
+                // The cache in KeyBoxManager will handle reloading it on its next use.
                 else ->
                     if (path.endsWith(".xml")) {
                         SystemLogger.info(
                             "Keybox file $path may have changed. It will be reloaded on next access."
                         )
                         KeyBoxManager.invalidateCache(path)
+                        if (Build.VERSION.SDK_INT > Build.VERSION_CODES.R) {
+                            // Clear cached keys possibly containing old certificates
+                            org.matrix.TEESimulator.interception.keystore.shim
+                                .KeyMintSecurityLevelInterceptor
+                                .clearAllGeneratedKeys("updating $file")
+                        }
                     }
             }
         }
diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
index 5a07822..7d1f7bc 100644
--- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
+++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
@@ -218,6 +218,15 @@ class KeyMintSecurityLevelInterceptor(
                 SystemLogger.debug("Remove cached attestaion key ${keyId}")
             }
         }
+
+        // Clears all cached keys.
+        fun clearAllGeneratedKeys(reason: String? = null) {
+            val count = generatedKeys.size
+            val reasonMessage = reason?.let { " due to $it" } ?: ""
+            generatedKeys.clear()
+            attestationKeys.clear()
+            SystemLogger.info("Cleared all cached keys ($count entries)$reasonMessage.")
+        }
     }
 }