You have to do the following below.
For El Capitan and newer, the procedure is as follows:
Disable SIP (System Integrity Protection):
Boot into recovery mode (cmd+R)
Select Utilities -> Terminal from the Menu Bar.
In Terminal, input the following command: csrutil disable
Reboot
Boot into Safe Mode:
Shut down the computer.
Hold the shift key down and turn the computer on. Keep shift held until you see the login/bootloader screen.
Input the password for a local account with administrative privileges and press Enter
Eventually you'll be prompted for a username and password. Input the username and password of the local account to login.
Remove the expired certificate:
Navigate to Applications -> Utilities in finder.
Open Keychain Access
In the menubar, click View -> Show Expired Certificates.
In the search box, type Entrust.
Select the expired certificate, then right-click it and select Delete.
Reboot the computer and boot back into Recovery mode.
Enable SIP.
Boot into recovery mode (cmd+R)
Select Utilities -> Terminal from the Menu Bar.
In Terminal, input the following command: csrutil enable
Reboot
After this most recent reboot, the BlueCoat agent will work again.