So, since this doesn't seem to be documented anywhere, this is what i ended up doing to migrate my keys:
1. Extract my cert and private key from the old Java keystore.
2. Download my ca's root cert.
3. Copy these to /opt/zimbra/ssl/zimbra/commercial/{commercial_ca.crt|commercial.crt|commercial.key}
4. Also copy to /opt/zimbra/mailboxd/webapps/zimbraAdmin/tmp/{current_chain.crt|current.crt}
5. Run /opt/zimbra/bin/zmcertmgr deploycrt comm |