What Kevin said. This is similar to this thread: SSL Cert Switch Over Best Practices
I will link this forum post to ticket IGN-5726 which will allow you to generate a new CSR with a new key pair when the Gateway is in a state where a certificate is already installed.