I've been trying to figure out how this is supposed to be done. We have AD Certs being issued with our 802.1x policy and when the certs get within 14 days of expiring a year later, users are notified that the cert is about to expire. When users go to System Preferences > Profiles and click on the 802.1x profile, there's an Update button they can click. The problem is that it doesn't actually RENEW the existing cert. It requests a new cert from our CA server. After it completes the "update", the computer then has 2 certificates named the same thing (the computer name). One that is expired and one that is new. Depending on what the user's actions are in their daily work, they may be prompted to choose which certificate to use but since both are named exactly the same, they don't know what to do. I end up having to go into Keychain Access to locate the expired cert and manually delete it.
Surely there's a better method of handling certificate renewals. Windows users don't have to deal with any of that garbage. The certs automatically renew and there's no confusion.
