Actually, I have never tested what will happen if you create a new keystore database. Why? - because it would just not follow the upgrade procedure. In NW, updating/upgrading means in general:   -  remove the old software version (binaries & DLLs) but leave all databases behind   -  install the new software and start the programs which will convert the databases, if necessary Well - in Windows, the process looks a bit different for the user but in general it follows the same track. The idea is not to change anything which is not necessary. To answer your question: I would strongly recommend to use the same/existing keystore.    
We plan to upgrade Networker Server to the current target code 19.2.1 from 19.1.1 (Yes I know they have the same EOSS date.) I have one question about the keystore and its password. In the code upgrade guide, it seems when you run the new code package file, there is a step you need to ‘Configure NetWorker Authentication Service Keystore’, and you can either choose ‘To create a keystore file’ or ‘To use an existing keystore file’. Will creating a new keystore break something existing? If I understand well, there are two certificates: ‘emcauthctomcat’ and ‘emcauthcsaml’ stored in this keystore. What are their purpose? How are they being used? What is a better choice: create a new one or use the existing one during the code upgrade?
Keystore options during a Networker code upgrade