You can generate or obtain new certificates when:
For procedure see Set up certificates for a community or Import certificates for partners.
If possible, perform certificate updates when your server is not processing outbound documents. By observing this precaution you can avoid documents being rejected by partners.
If you generate a new self-signed certificate because the old one has expired, become defective or corrupted or cannot be used for any other reason, you should export your certificate to a file and distribute it to your partners by a secure means, which includes in-person, standard mail, or private delivery service.