Once per year or less. Remember to decrypt messages, you need to keep your old certificates/keys around. You can request a new certificate with the same key but i'm not sure that's a good safety practice.