How to write a new cert on EPF1 and how to DRK Fix


So I never understood the whole process and the right components I need to take care of in order to have a fully functional phone after the cert is changed. I have a G925T with EPF1 update and a Z3X box with all updates, drivers, softwares needed installed and in the right place.
My phone has been flashed with a certificate from remote after I wiped the EFS folder, this happened when I was using 5.1.1 and obviously the EFS folder had the security damaged. But the person who changed my cert claims that he fixed the security. After that I updated my phone to marshmallow and it came out that DRK was bad and the phone could not boot without a custom kernel. The same person fixed the DRK and my phone was able to boot with the stock kernel. But the phone was not working in the way it should. So after I did the latest update, EPF1 the phone boots fine starts working, it looks like its working fine, but in fact, it get stuck and freezes every 2 minutes for about 5 seconds when I am using it. It does not matter what I have opened, it just freeze.
So I think this is a EFS, or Security or DRK problem, since the DRK was fixed when I was in 5.1.1 and the early update of the marshmallow.

I know that DRK is a big deal, that’s why i am trying to fix that.
I already tried to flash a new certificate and fix drk but it keeps giving me error 9 code and some other errors. IDK what I am doing wrong.

Now my question is:
Is there any way so I can write a new valid tmobile certificate to G925T with EPF1 with Z3X and have do DRK fix?