For just iOS push/messaging, then when your push cert expires you would generate a new one and upload it to firebase. The push certificate is only needed by the server that sends the push notification. The push cert tells the Apple push backend that your server (or firebase’s server, in this case) has permission to send push notifications to a given App ID. In other words, if your push certificate has expired and you want to keep being able to send push notifications through firebase, you would need to renew the certificate and upload the new one to Firebase. You would not need a new build of the app.
Separately, if the app distribution certificate expires you won’t be able to build with it or upload builds generated with it. You’d need to generate a new certificate and upload that to the Builder, and also re-generate and upload any provisioning files that used the old certificate since they’re now expired. I don’t believe apps already in the store would be affected (beyond the fact that you won’t be able to upload a new build until you setup the new certificate).
You’ll be notified by Apple when your Push Cert, also called APNs Development iOS expires.
You’ll generate a new one in the apple developer portal. Download and then upload into Firebase. Simply go to your Firebase app settings, delete out the old APNs Development cert and upload the one you just generated.