Replace existing SSL certificates in Samba with own certificates from internal CA

I want to replace the self generated SSL certificates from Samba with customs ones. What is the proper way to do it ?
I’m running UCS 5.0 core with the latest updates
These are the lines from smb.conf which point to the TLS settings for Samba.

tls enabled     = yes
tls keyfile     = /etc/univention/ssl/path/private.key
tls certfile    = /etc/univention/ssl/path/cert.pem
tls cafile      = /etc/univention/ssl/ucsCA/CAcert.pem
tls verify peer = ca_and_name

I searched trough the forum but I did not find a proper answer yet.
Thank you.