To renew an expired certificate:
certreq -enroll -machine -q -cert “<SN>” renew reusekeys

To renew an expired certificate (with a new key):
certreq -enroll -machine -q -cert “<SN>” renew