Success
Here are steps i followed.
Exported valid cert to pfx format. Remember the export pw for later. I used a recently renewed 3 year wildcard cert for our domain. I used this one for Exchange CRM, now JIRA because reasons.
Copy pfx file to a place on linux server, i made a folder called /certificates
copy pfx over existing pfx file in /etc/pki/CA/certs/domain.com/domain.com.pfx
Open server.xml file located in
/jiraapplicationfolder/jira/conf/server.xml
Find the blob of text that begins
"To run JIRA via HTTPS:"
blahblah, a bit farther down
<Connector port="yourhttpsport" protocol="org.apa...
Find the following parameters, change to correct values in server.xml.
keystoreFile="path/to/pfx"
keystorePass="exported private key pw"
Restart tomcat, or the whole server if you want.
Your cert is now updated.