Up to 100, any or all of which may be wildcards.
You can replace it with a new certificate.
90 days.
Yes, but you need to set up the software to do this on your side.
There is no absolute upper limit, only the rate limits that @JuergenAuer linked above.
As an aside, AWS Certificate Manager is provided to Cloudfront users at no additional cost, so that may be a better fit for you - unless you've already tried it and found some limitations?