There seems to be no easy way but to start from scratch every time. Although it is best to do this before the certificates expire--if the certificates do expire on you, just follow this same procedure all over again. It is a subset of the steps you would have followed when you first generated your original self-signed certificates (except of course now you are not recreating your virtual network nor recreating your VPN gateway on Azure, etc. Rather, you'll just update the public certificate data for it on step 2 below).
And yes, in the process (steps 1 and 2 below) you will create a new root certificate and have to paste public certificate data up on the Azure portal (https://portal.azure.com). You are allowed to keep several (up to 20) such certificates there, and the purpose of that is to anticipate certificate expirations and prepare your Azure cloud with the next valid certificate before the old one expires.
Aside from the downtime your users will temporarily experience if the certificates do inadvertently expire and you haven't prepared new ones to replace them earlier, you are basically not missing a beat by just following the very same steps below.
NOTE: Any VMs up on the cloud won't necessarily need to have the certificates installed too (unless you're using them there as well for some other purpose requiring encryption). Only the clients will. The Azure point-to-site gateway's certificate data (which handles your VPN connections) is all that needs to be updated up on the cloud per step 2 below. And of course, you've got to update the clients' certificates (step 3).
- on your administrator's PC--the local, physical computer or server you've chosen to serve as the master location from which you'll create your certificates--regenerate all self-signed certificates (both root and clients, as though starting from scratch--so basically follow all the steps on the link specified for this step here) per https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site
- paste the root key text onto the Azure portal (portal.azure.com) per the steps titled "Upload the root certificate public certificate data" at https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal#uploadfile. Beware that you will need to remove any expired certificates here prior to saving your newly pasted one or otherwise your save operation on the Azure portal will fail.
- install the client certificates on all the client PCs per https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-how-to-vpn-client-install-azure-cert
- on the Azure portal regenerate the VPN client configuration file per https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-configuration-azure-cert and then install it on each client PC
Once you've followed the above steps, your clients should be able to reestablish their VPN connection to your Azure cloud (and get rid of Error 798) and be able to do all their work there as before.