Here is the June installment of the new monthly communication from the InCommon Certificate Service. Each month we will highlight a frequently asked question from the list along with its corresponding responses as well as added notes from our team when needed. Please let us know if there is a question that you would like to see addressed in a future installment of The Latest from the List. In the meantime, keep the great dialogue going on the list!
—Paul Caskey, Program Manager, InCommon Certificate Service

Q: What options do we have for cleaning up old certificates? Also, what options do we have to silence the expiry/renewal notices?   
With the annual renewals, they’re really starting to stack up. We’ve been generating new CSRs with new keys, so we’re not “renewing” the existing cert.  The expiry notices keep coming, creating a lot of noise, and causing some folks concern.
—Ian Altgilbers, Senior Systems Administrator, Educational Technology Services, Tufts University

A: I always renew certs and then edit them and copy/paste in the new CSR.  This silences alerts on the old certs without revoking them, so they’re still good for the amount of time I need to update them on the server. You should also be able to revoke the certificates you're recreating, and that should prevent the expiration notices as well.
—Ron Rossman Jr., Systems Administrator, Penn State IT Solutions Engagement Team, The Pennsylvania State University

A: The filter is the best way to view and clean up what is listed. Certificates cannot and will not be removed because of Web Trust Audits. To silence renewal notices if you don't want to be notified, you can suspend notifications on the certificate itself. If you don't want to be notified at all (completely), then either the RAO or InCommon will have to remove the email /user from the email notification. 
—Caleb Kennedy, Service Account Manager, Sectigo