You have to “reissue” the certificate. First step is to create a new Certificate Signing Request (CSR) on the host. CPanel allows you to put multiple domains on the CSR, and that’s how you add a new domain to an existing certificate.
Next step is to “reissue” the certificate. I used Namecheap, and the instructions for getting to “reissue” are here: https://www.namecheap.com/support/knowledgebase/article.aspx/811/70/how-do-i-reissue-my-ssl-certificate their screen shots are out of date. The “Domain list” page is here: https://ap.www.namecheap.com/Domains/DomainList
Then I verify my identity with Namecheap. There are different methods — email, HTTP, and DNS.
Eventually they issue a new certificate. I save the .zip file to my computer so that I can upload it to my host. CPanel has a section for SSL/TLS where I can upload new certificates, which I do.
CPanel wants a .crt file. It accepted the .zip I got from Namecheap, but it didn’t actually stick. so either upload the .crt or paste the text of the certificate instead.