Or else I can renew the certificate? Without having to generate a new msi package?

Yes, you will need to regenerate and redepoy packages. Ideally you use a trusted certificate (such as Let's Encrypt) and then you won't need to redeploy agents when the certificate expires (you just generate the package without specifying

fleet-certificate

).