How to update a server certificate
Step-by-step guide
Note: The CRM_AIA_org.ks File is Password Protected.
Ben Hollenbeck can get you a certificate from a service like Digicert and @Yamini Kannankutti (Unlicensed) can Convert the Certificate from .pfx to .ks format
The Salesforce Administrator must then go to Setup >>Certificate and Key Management and find the expiring certificate. Refer to tutorial
When you try to delete the expired certificate you will notice that the "Delete" button is grayed out. This is because it is referenced in the Identity Provider.
As mentioned the Tutorial go to the identity provider and disable the identity provider that references the certificate.
The Salesforce Administrator can then Install the SSL certificate as described below
https://help.salesforce.com/articleView?id=000339841&type=1&mode=1
Refer to Tutorial on the steps belowFinally Merge a complete certificate chain for custom HTTPS domains
https://help.salesforce.com/articleView?id=000333504&type=1&mode=1