How renewal works — do I re-paste the key in cPanel every time?

Free plan: yes. Every ~90 days you re-verify (Step 2), download the three new files (Step 3), and install them in cPanel → SSL/TLS, replacing the previous certificate, key, and CA bundle. All three must be replaced together — a new certificate with last quarter's private key won't work. Budget 10 minutes per renewal.

Premium plan (cPanel): no. After the one-time setup, the plugin re-verifies, re-issues, and re-installs into cPanel automatically about 30 days before expiry. You don't touch keys again; you'll just get a confirmation email. If you're renewing manually more than once while on Premium, something's misconfigured — contact support and we'll check your renewal logs.

How to tell which certificate is live: cPanel → SSL/TLS → Manage SSL Sites shows the certificate's expiry date for your domain; compare it with what SSL Zen's Settings page shows. They should match after every renewal.