Hello, this happened to me few times, when ISE get into some troubles and I had to reinstall it. However I had only cert, without private key (I did not export it prior re-installation). So I think something similar happened to you too - I think you generated CSR, engaged CA to sign it (generate new cert) and in the meantime you upgraded ISE. Now, you have only the signed cert but no CSR you can bind it to ( and also no private key). From my experience, there is no other way to fix this than issue new CSR, use it to re-issue cert and bind the cert to CSR then.
The reason why you cannot install just cert now (without having a CSR) is that when you create CSR, there is also generated a private key which remains on the system. Then, when you have new cert issued, it is bind to that CSR (and also private key) present on the system. Then, to be on the safe side then, you can export both after binding it.
If you'd have the cert installed prior to upgrade, you could export it along with a private key and then install both of them back after the upgrade (without a need of having CSR). But this is not option now because again, you don't have the private key - you did not export it prior upgrade.
Good news is that all major CAs that issue certs, should have an admin interface where you simply upload CSR and re-issue cert, without paying or purchasing new cert. I mean - and this is important - once you have purchased the certificate before and the cert is still valid, you have a right to get the cert RE-ISSUED without any additional costs. I recommend you to get in touch with the person who has access to this admin interface of the CA, provide that person new CSR, so he/she can upload it and then re-issue cert. Again, my experience is I've never ever payed additional costs for this, as the cert was still valid. I just generated new CSR, uploaded it and the RE-ISSUED the cert.
