How you renew depends entirely on which kind of certificate you have, and the two paths have almost nothing in common. An automatic certificate renews itself and your only job is noticing when it stops. A commercial certificate renews when a person remembers, which is why expired commercial certificates are one of the most common causes of a site suddenly showing a browser warning.
Find out which kind you have
In cPanel, open SSL/TLS Status. It lists every domain with its certificate and expiry date, and shows whether AutoSSL manages it.
If AutoSSL manages it, renewal is automatic. If it was installed manually, it is yours to renew.
Automatic certificates
These are typically issued for 90 days and renewed around 30 days before expiry, without anyone doing anything. The short lifetime is a strength: a certificate renewing every 60 days automatically fails far less often than an annual one depending on somebody remembering a date twelve months away.
There is one thing worth doing: check the status page occasionally. Automatic renewal can start failing quietly, and the first visible symptom is a certificate warning on a live site.
When it does fail, the cause is nearly always one of three things.
DNS changed. The domain no longer resolves to this server, so the authority cannot verify control. This is the most common cause by a wide margin.
A redirect is interfering. Verification requests a specific path over HTTP, and an aggressive redirect rule or a firewall rule can block it.
The domain was removed or changed in a way that took it out of AutoSSL's list.
To force a renewal attempt, select the domain on the SSL/TLS Status page and run AutoSSL. If it fails, fix the underlying cause, retrying alone will not help.
Commercial certificates
These expire on a fixed date, usually a year after issue, and nothing happens automatically.
Start about a month before expiry. The steps are the same as a first installation.
Generate a new CSR in cPanel under SSL/TLS. Some vendors accept the original, but generating a fresh one also generates a fresh private key, which is better practice.
Buy the renewal and complete validation. For a DV certificate this is quick. For OV or EV, allow several days. The vendor re-verifies the organisation, and that is not something to start the week it expires.
Install the new certificate through SSL/TLS then Install and Manage SSL, and paste the CA bundle into its field. The bundle is the part people skip, and it produces the specific failure where the site works in your browser and shows a certificate error on other devices.
Then verify from a device you did not do the work on.
Set your own reminder
Vendors send renewal notices to the address used at purchase, which twelve months later is frequently a developer who has left or a mailbox nobody reads.
Put a reminder in your own calendar six weeks before expiry. This is the single most effective thing you can do about commercial certificates, and it costs nothing.
If you host several sites, keep a list of expiry dates. Checking it monthly takes two minutes and prevents the situation where you learn about an expiry from a client.
Moving from commercial to free
If a commercial certificate is coming up for renewal and there is no specific requirement for it, letting it lapse in favour of the free automatic one is usually the better arrangement. The encryption is identical, and automatic renewal removes the failure mode entirely.
Keep paying only when a partner, processor or auditor requires it in writing, or when the warranty matters to you. Types of SSL certificates walks through the difference honestly.
To switch: let AutoSSL issue for the domain, confirm on the status page that the new certificate is active, then verify the site in a private window. There is no gap if you do it before the old one expires.
When it has already expired
Every visitor now sees a full browser warning, and most will leave rather than click through. Treat it as urgent.
For an automatic certificate, run AutoSSL for the domain. If it fails, check that the domain still resolves to this server; that is the usual reason renewal stopped in the first place.
For a commercial one, the fastest route back is often to let AutoSSL issue a free certificate immediately, which takes minutes and restores the site, and then sort out the paid renewal without time pressure.
After any renewal
Load the site in a private window and check the padlock. Test both www and the bare domain, and any subdomain that has its own certificate.
Check from a second device or network as well. Missing intermediate certificates are invisible on the machine that did the installation, and that is precisely the failure a renewal reintroduces most often.
If something is wrong afterwards, the SSL troubleshooting guide explains what each browser warning actually means.