I have done extensive testing and found the following:
Return line and end of line characters are not even being parsed so they can be excluded. (whether at the beginning or end of your regex).
Hex can be defined as [A-F0-9{8}], however if you try to match more than 2 variables with this regex, it will break (probably a bug) so you can simply use [A-F0-9{8}]+ for the certificate hex.
As well to further explain the pattern matching, if the line says for example "Hello how are you" and you created a regex, "el" that line would be excluded in entirety. This does not exclude the section though, a section is all the lines between exclamation points. If you have any line without any pattern that matches the whole section gets flagged as changed. This is explained on the linked page previously noted.
So for pattern matching, be as specific as possible if you do not want false exclusions and want proper reporting. The issue with the Hex pattern above is something I have already opened a ticket on.
If you want to properly test your regex's edit 2 configs. In the first just create 2 lines with "!". In the second create 2 lines with "!" and put the line you want to test your regex against in between them. This will allow you to highlight the two edited configs in NCM created a regex and compare.
I hope this helps so that people can start creating better regexs and get the issues I have found during testing addressed.
Also, here are my cert regex's that work and aren't wild blasts that may or may not work, these are specific to certs:
^ntp clock-period
^wlccp ap username cisco
crypto
self[-]*signed
[A-F0-9{8}]+
^ pre-shared-key
quit
revocation-check none
rsakeypair
serial-number
^!
This should fix your cert issues on all devices and resolve inconsistencies. However, do not blame me if you get improper reporting as you should be creating more specific regex's than what I have just provided.]
Lastly, it also looks *like* the regex's are not even case sensitive if you are not using brackets. ie, serial-number and Serial-Number would both match the same config lines.