To all,
The process went smoothly towards upgrading the ISE nodes with only one hurdle.
All done from the Primary PAN, one node at a time and the Primary PAN last.
Create the cert requests make them 'multiuse', download them but afterwards do NOT touch/sneeze at/delete these certs from the PAN. They are needed later.
Have a 3rd party validate/create the certs required.
Download your new validated certs from your 3rd party, also their Intermediate and Root certs. Upload the 3rd party Intermediate and Root certs into the Primary PAN trusted cert area.
Back on the Primary PAN and in the certs request section, select a cert previously created for a particular node and 'BIND' them to the relevant cert created by the 3rd party. Next, make sure you select the other options exactly matching the older certs you are replacing.
Before clicking apply, ssh into the node and monitor with the command 'show application status ise'
Bind the new certs, agree/apply, monitor the node being updated via ssh and wait until all processes have restarted. Do not delete the old certs yet, the clean-up can be performed after.
Test all your known OS clients available, I had a range of byod devices to test and on a couple I've had to accept the new certs.
Notes: Some of the OsX/iThingys had been previously onboarded with a dot1x profile, delete that dot1x profile and the remembered/relevant wifi connection. Then reconnect to your wifi and accept the new certs. The one hurdle and biggest nightmare of all were Win10 devices, all other OS client/devices played nicely. I now have a dream... if feasible, ban all Win10 devices from the enterprise even OsX played nice!