Change the formatting and add some xrefs

Author: NataliaIvakina

modules/ROOT/pages/security/ssl-framework.adoc

@@ -1108,22 +1108,33 @@ Beware that the SSL debug option logs a new statement every time a client connec
 To avoid that scenario, make sure this setting is only enabled for a short term duration.
 ====
 
+[role=label--new-2025.03]
 [[certificate-rotation]]
-== Certificate Rotation
-It is considered best practice to use certificates with reasonably short duration. This, however, requires the periodic rotation of certificates whereby old certificates are removed and the new ones installed. Previous versions of Neo4j required a the restart of a database instance for changes to be applied. New certificates can now be rotated in and SSL configuration changed without a restart being required. This reduces undesirable effects of transient loss of cluster members. 
+== Certificates rotation
 
-. Enable the dynamic reloading of certificates on all cluster members. It is best to do this when the cluster is deployed as changing this configuration requires a restart:
+It is considered best practice to use certificates with reasonably short duration.
+This, however, requires the periodic rotation of certificates whereby old certificates are removed and the new ones are installed.
+Previous versions of Neo4j required a database restart for changes to be applied.
+Starting from 2025.03, new certificates can be rotated in, and SSL configuration can be updated without requiring a restart.
+This reduces undesirable effects of transient loss of cluster members.
+
+Following are the steps of newly introduced certificates rotation.
+
+. Enable the dynamic reloading of certificates on all cluster members.
+It is best to do this when the cluster is deployed as changing this configuration requires a restart:
 
 [source, properties]
 ----
 dbms.security.tls_reload=true (default is false)
 ----
 
-. Replace old certificates either by overwriting on the filesystem, or copying them to a new location and updating the required SSL configuration for each effected scope. Both certificates may exist on the filesystem but only one can be referenced in the configuration. New certificates will need to be copied to all cluster members as required.
+. Replace old certificates either by overwriting on the filesystem or by copying them to a new location and updating the required SSL configuration for each effected scope.
+Both certificates may exist on the filesystem but only one can be referenced in the configuration.
+New certificates need to be copied to all cluster members as required.
 
-. Make necessary changes to any of the SSL configuration. and/or replace certificates for effected scopes. 
+. Make necessary changes to any of the SSL configuration and/or replace certificates for effected scopes. 
 
-. Connect to each cluster member in turn using Cypher Shell using a bolt scheme and run the reload procedure:
+. Connect to each cluster member in turn with Cypher Shell using a <<ssl-bolt-connect,`bolt` URI scheme>> and run the reload procedure:
 
 [source]
 ----
@@ -1132,7 +1143,7 @@ dbms.reloadTLSCertificates()
 
 . New settings will take effect immediately, however existing connections will not be pre-emptively terminated.
 
-. Verify that the intra-cluster communication is still encrypted using external tooling, such as Nmap, described above.
+. Verify that the intra-cluster communication is still encrypted using external tooling, such as Nmap, described in <<ssl-cluster-config, Configuring SSL for intra-cluster communications>>.
  
 
 [[ssl-terminology]]