CA-signed certificate to update with a certificate already signed

Hi all,

I need to renew a CA-signed certificate, and I already have the new signed certificate. However, I need clarity on few steps.

I am trying to follow this: https://help.salesforce.com/s/articleView?id=000381846&type=1

I have a .pfx certificate (with private key) and I managed to convert it into .jks

Now, I am trying to follow this step: 

Upload the JKS in an org without CA signed certificates (e.g. a virgin dev org or sandbox). This will generate a proper, signed certificate in the org.

I went to a sandbox without certificates and... I don't understand where to upload the .jks 

It won't be accepted on a new CA-signed certificate (as it happens in my org). 

Can someone provide more detailed guidance?

Thanks!