Replacing STS Certificates on Vcenter 6

I'm trying to replace the STS signing certificate in Vcenter with an enterprise signed one but have been running into a problem where most of my vcenter services begin showing as "unknown" status after I upload the new cert. I'm following the same procedures that worked for us in 5.1 but no luck here. Can anyone point me to some documentation about the proper way of generating a new JKS file for this situation? The VMware documentation doesn't go into much detail about the specifics.