I want to update expired local certificates for my local Sitecore Commerce and CMS instance but don't want to change thumbprint.
What is the procedure to do this
I think this is more than a generic SSL or IIS question, not a Sitecore one. but from StackOverflow - https://stackoverflow.com/questions/10440806/how-to-renew-an-iis7-self-signed-ssl-certificate simple answer is -
No, it's not possible.
Because you have chosen to use a self-signed certificate that you have explicitly configured to be trusted in your client. If you replace that certificate with a new one with different validity dates (even with the same keys, although it's probably best to change the keys too), it will be a different certificate. Being different, it won't be the same as the one you had imported in your clients in your initial set up (logically).
If you want to be able to do silent renewals, then you need a self-signed CA certificate. You emit certificates for your server(s) from that CA, and you ask your clients to trust that CA.
The second and better option is that next time you produce a self-signed certificate, make it long-lived. Certificates expire mostly in order to make revocation work (certificate expiry prevents CRL from growing indefinitely). For a self-signed certificate, there is no revocation, so you can make the certificate valid for 20 years or more. I personally think with the Sitecore local environment setup we should have the option to choose "certificate valid for" time.