I realize now that I should have done a dry run

[Phil]

@cjohnsonsr1

What I’d really like is to be able to get rid of the existing certificate and just generate a new one when I’m ready with the newly rebuilt system.

In that case, simply rebuild your system and the old cert will eventually expire. If you really wanted to you could revoke it, but that's unnecessary.