Just generate the request on your Windows server or with openssl. Sign it, get the key, certificate and CA certificate in PKCS#12 format and upload it at the "Remote Access >> Cert Mgmt >> CA" tab in WebAdmin. This will regenerate all VPN certificates with the uploaded CA. Future ones will of course also come from it.