From the client area. You can actually start to renew 1 month before expiry
No, you still need to manually install the renewed cert(s)
Likely this issue