You generate a new CSR + private key and reissue the cert through the vendor. All the ones I've purchased allow reissuing as often as you like. The expiration date never changes obviously, but reissuing is a common practice.
I was referring to the time spent doing something like that and the delay in response because of a lack of automation around rotating certs.