If memory serves, you need to open KeyChain and create a certifcate request
Then log in to the Developer area of iTunes Connect, and navigate to the certificates section
There, request a new cert by uploading your request file (use the same one for all of them)
Then download each cert and double click on it to get it into keychain.
Possibly then removing the expired one so as to get less clutter
This is the tricky thing. The signing certificate you are issued is valid for five years. Your Apple Developer account is a yearly thing. You can sign with a certificate you were issued if your Apple Developer subscription expires.
Edit: I’m not sure if you can recover a signing cert from an expired developer account though.