for CA-Signed certs updating expiring ones, does the server.keystore need to have a specific private

for CA-Signed certs updating expiring ones, does the server.keystore need to have a specific private key? or can it use the original one when it was created?

meaning what has to match?

I believe I can create a bundle by just concat all 3 certs (root, intermediate, and cert)

but what do they then match against?