Filter certwatch alert in audit.log and process it to audit2allow to build a corrective pp :

grep certwatch /var/log/audit/audit.log | audit2allow -M mycertwatch2

make the policy active :

semodule -i mycertwatch2.pp