Inventory every service using the certificate: SMTP relay, submission, IMAP, POP, HTTPS policy hosts and load balancers.
Install the new certificate and intended chain.
Then connect to each public service and inspect the certificate actually presented. A file existing on the server does not prove the daemon or load balancer loaded it.
Keep the old key/certificate only as long as required by your rollback and security policy.
Automate expiry monitoring.