Oneconnect behavior while updating server certificates

My understanding is that the F5 doesn't care about underlying SSL connection with OneConnect. The backend TCP/SSL connection is pre-established and is not torn down but used for new HTTP requests from a client that matches OneConnect parameters. However, when you take down a pool member (i.e., the member fails health-check and is marked down), after the relevant time period, F5 will recognize the member being down and stop sending new connections to member marked down. F5 may continue utilizing the existing connection to send requests to the down member. One way to work around this is to set the "Action on Service Down" to reselect or reject depending on your application.