Merge "Check upgrade certs before permissions." into lmp-mr1-dev