My reading of your original post is that you started by creating a CSR on the FortiGate. This generates two "things": the CSR itself, and a matching private key.
When you the uploaded the signed certificate for the first time, it was matched to the private key. So now you should have the private key and the "old" certificate as an object in "config vpn certificate local", unless you deleted it already.
Assuming you haven't sent any new CSR to your CA, that implies that the new certificate they provided you still matches to the "old" private key. So the goal is to have the old privkey + new certificate in a single object in the FortiGate configuration.
That can be achieved by one of the two methods I described in my other reply:
1, Manually edit the old/existing object, and replace the old "set certificate" value with the new one.
2, Upload the privkey and the new certificate as a new object. For that you will need to export the private key out of the configiration, which can only be done if you know the password for the private key. (if you set the password manually during CSR generation and still remember it, you can; otherwise it is not possible)
2b, (alternative) Copy the entrire CLI content of the existing object, edit it in an editor, then paste it in as a new object:
- show full vpn certificate local <old-cert-object-name>
- copy that into a text editor (notepad, notepad++, etc.)
- change the name (edit "oldname" -> edit "newname")
- update the 'set certificate "xxxxx"' content, replace it with the new certificate.
- copy the entire modified snippet and paste it into FortiOS CLI.
-> this should create a new certificate object with the new certificate and the old private key (without having to know the password).
