I’ve tested it somewhat. I think you’ll want to set the password for the .pfx if applicable, and the certificate must be .pfx, before you upload it. You can also simply copy them to the correct folder.
Logged in as system admin, Settings-> SSL Certificates
In the options tab, you’ll want to set the pfx password if you’re using one
In the next tab you’ll see your certificate details. If the .pfx is password protected, and you didn’t set that password on the previous tab first, there will be an error and (a couple builds ago) entering the password after the fact didn’t help, but I simply deleted and replaced the certificate file and it worked. I did not investigate further.
I’m using CTW, and it automatically copies the new certificates .pfx over the old one and it just works.