Forget oldSSL cert after first cleanup

controllers/gce/controller/cluster_manager.go

@@ -165,6 +165,7 @@ func (c *ClusterManager) Checkpoint(lbs []*loadbalancers.L7RuntimeInfo, nodeName
 	if err := c.firewallPool.Sync(fwNodePorts, nodeNames); err != nil {
 		return err
 	}
+
 	return nil
 }
 

controllers/gce/loadbalancers/loadbalancers.go

@@ -344,6 +344,7 @@ func (l *L7) deleteOldSSLCert() (err error) {
 			return err
 		}
 	}
+	l.oldSSLCert = nil
 	return nil
 }