Thank you a lot for your answers, that makes it more clear! The new root certificate is installed on the server. I have switched to using sandbox environment to test if it would be working but I get error: "reason":"BadCertificateEnvironment" does it mean that the root certificate is not installed correctly or that is a different issue?

My mistake, it was on the ProfileList, but still unsigned and with that error on the device in system logs.