Full details here, but here’s the gist. If you get an email from PayPal telling you that your API certificate is expiring (or about to expire), but when you go to the appropriate page and discover the renewal button is missing, delete your expired certificates. The renewal button will then (hopefully) appear, allowing you to renew your API certificate.
Why am I telling you this? The answer is, I am not telling you this. I am telling the exasperated person down the line who will encounter this problem, and then discover that PayPal can’t be arsed (pardon my British) to clearly explain what to do. I found the above link only after seriously looking for it, so clearly it needs a signal boost. We’re all Bozos on this bus.