How to remove Expired Certificate in Certification Authority

Question

So the base certificate at a client site running Server Standard 2012 R2 expired.
I went in and did a renewal, which created a new certificate, but the old expired cert still shows in the list and is still being handed out by the CA.
Certificates #1 & #2 are the renewed cert's, Cert #0 is expired, why did it not get replaced during the renewal process?
How do I remove the expired Certificate?  The CA is still using it and handing out expired cert's, this is preventing people from connecting to the secure Corporate WiFi environment because the NAP server is now rejecting access due to an expired certificate.
Before I renewed and changed the certificates in the NAP server to point to the new reviewed cert, I was getting this event log entry when a user tried to connect to the Secure Corporate WiFi:
Event ID 6273, Reason Code 262, The supplied message is incomplete.  The signature was not verified.
After I changed to the Certificates in the NAP server to point to the renewed cert's, I get this error, still not able to connect to WiFi:
Event ID 6273, Reason Code 265, The certificate chain was issued by an authority that is not trusted.
How do I go about cleaning out that Expired Certificate in the CA, I removed it from the computer cert list using the Certificates snap in and connecting to the local computer.  I then stopped and restarted both the CA and NAP services.  Still
no change.  I need to get the CA cleaned up and trusted again.
Any help would be greatly appreciated.
Curt Winter
Microsoft Certified Professional

Answer 1

Ok the NAP server is now working properly, the Expired Certificates are clean up and we are back in working order.
Here is a review of what I did to get the issue resolved:
1) First thing was to remove the old SBS server entries that where causing the workstation to try and renew their certs with the old server.  To do this I ran ADSIEdit expanded the
CN=Configuration | CN=Services | CN=Public Key Services.  I then went through every folder and every entry under Public Key Services looking for and removing or updating entries pointing to the old SBS. I then made sure authenticated
users had read permissions on CN=Enrollment Services.
2) Ensure the CA is an Enterprise CA, I ran certutil -cainfo
to ensure it showed as Enterprise Root CA.
3) I then went back into ADSIEdit expanded
CN=Configuration | CN=Services | Public Key Services | CN=Enrollment Services. Right click the CA in the right pane and ensure
flags is set to 10.
4) Ensure the CA is trusted, launch PKIView, right click on
Enterprise PKI and select Manage AD Containers click on the Enrollment Services Tab, the status should show as OK.
5) I then copied that Certificate to a file and ran certutil -verify on the file to check for any additional errors.
6) I then opened CertSrv.msc on the CA, right click on the name of the CA and select properties, click on the Security tab and ensure Authenticated Users have the
Request Certificates permission.
7) I then ran certutil -deleterow 3/11/2015 Cert to remove all the certs that had expired before 3/11/2015.
At this point the workstations started to get new cert's all the cert renewal errors in the client event logs stopped
8) I then went back into the NAP server and select the correct certificate fin the EAP Properties and Smart Card properties.
9) I then updated the domain 802.11X policy ensuring all the EAP properties had the correct certificate listed.
At this point computers where again connecting to the Secure WiFi through the NAP server.  I hope this may help someone in the future.
Curt Winter
Certified Microsoft Professional
Curt Winter