(Databox 0.5.2)
The container-manager certificate is used by the databox HTTPS server. It includes the discovered IP addresses of the databox when generated.
It is only generated when the databox is first started and subsequently persisted. So if the databox changes IP (e.g. DHCP lease expires or moves to new network) then the IPs are wrong and HTTPS connection fails/is marked insecure (depending on browser).
While the root certificate should be regenerated (so it doesn't need to be reinstalled), this one should be if the databox IPs change.