Usually the certs should renew automatically as it was in NS7.
There was a bug when certificates for NS8 apps were obtained on the TLS certificates page in NS8. The apps have their own certificate and it doesn’t need to be obtained manually.
Please check in following thread if your system is affected and how to remove the wrong certs and make renewal work again: