The orderers need to be configured to allow the expired admin certificate to be used to sign the change to the channel configuration.
This can be accomplished by overriding the orderers to allow expired certificates to be used:
Set the NoExpirationChecks for each orderer in the orderer.yaml and restart.
Construct a channel update with the new admin certificates.
Update the channel using the expired certificate to sign the update.
Remove the orderride in the orderers and restart.