Replacing expired SSL certificate for WebAccess 7.0A

[niagarac]

Our GW 7.0A e-mail Webaccess server Public certificate has expired for SSL e-mail access, Private key is still valid.
The CSR was generated using the Admin Utility GWCSRGEN, creating *.cer and *.key files, which were sent to Thawte. In return we rec'd a *.cer file.

All attempts to replace the expired Public cert have failed, usually with error 1,227. Have only been using ConsoleOne 1.3.6h, e-dir 8.7.3, PKIS 2.x, Have not tried using iManager.

Do I need to start from scratch and create the KMO, *.b64 file and submit that to Thawte or is there some other way to use the new cert we've already paid for?
Thanks for any help.