When you add a Custom Domain to a Vercel Project, Vercel generates and assigns an SSL certificate automatically to it. All certificates have an expiry date when they are created and therefore, need to be renewed before the expiry date in order for your domain to continue to work properly.
Vercel attempts to renew certificates automatically within a 14-30 day period before it expires. While most certificates are renewed at the 30 day mark, it is not unusual for certificates to be renewed at a later date due to a combination of factors.
If your domain is misconfigured, the certificate will likely not be renewed. You can check the configuration state of a domain by going to your Project settings and navigating to the Domains section.