Why might a certificate import fail, when uploading a certificate not created from a Salesforce-generated Certificate Signing Request?

Question

I've been given two X509 certificates to upload into an org for use in SSO (one for signing, one for decrypting), but I can't seem to upload either of them successfully.

As I've been given the certificate (rather than me enter the cert details in Salesforce, generate a certificate signing request, then give that to the security team to create a signed cert), I've had to enter the details on the cert into Salesforce, then try to upload the certificate. When I do this, I only get this message:

The certificate that you are uploading doesn't match the generated certificate signing request

We've been through a few cycles already - in previous cases, the certs came without some of the key details on them that Salesforce requires on the detail page, so I've requested new ones. This time round, all looks good.

I've also tried creating a keystore - upon uploading it and entering the password, I don't get any error, but nor do I see any additional certificates appear.

I'm going to contact Support directly, but wondered if anybody had any experience or suggestions? The cert is created by a certificate authority the security team controls rather than Verisign et al, but my experimentation leads me to believe this isn't an issue. Cert management isn't something I do a lot of, so without more of a hint from the error message, I'm not sure where I go from here. Each time we go back and forth, it introduces further delay, so I'm doing all the digging I can.

Possibilities I can think of:

1. Possibly something to do with the certificate chain (or lack thereof)?
2. Mismatch on the Expiration Date? I can't change this on the Salesforce certificate detail page, and it doesn't match what's on the cert. Is this checked upon upload of a cert? I don't think the CSR includes an expiration date, so don't see how the CSR can not match on this, but maybe the error message is slightly misleading here?
3. Referencing this excellent answer - it looks like only the public key is contained in the certificates; could this be the issue?

Appreciate any help!