I'm also using Zen and ran into the same issue. Rather than fight and try to find the files on the various appliances, I purchased a certificate from a CA. I generated the CSR from the gateway.
This solved my issue; I was able to .crt file delivered by the CA to a PEM. After I manually combined the keys into one file, I was able upload it to Zen.