Assuming:
1) The nodes system certificate is still valid and trusted by your PAN
2) They are synced up to your PAN within the deployment
Then you can issue new ones via the PAN. This is done via issuing a CSR request for the nodes via PAN, filling them in, issuing a new certificate based on the CSRs with your CA and then binding each certificate to its CSR. After you've done this you can delete the old system certificates via the PAN if they are no longer needed.
If they are expired that's a different issue. I know that a system certificate is generated on ISE install (can be done via CLI), but if it's expired then it perhaps you can't add it to the trust store (hopefully someone can correct me if you can). If the certificate can't be trusted, you can't generate or import a new certificate if the node if part of a deployment. In this case you'd have to reset the application via CLI to make it a standalone with a new certificate and rejoin it to the PAN.
