Profile Manager Device Identity CA

Are you sure your CA expired? I thought that was added only 2 or 3 years ago (when Apple changed how it does SCEP) and it should have at least a 5 year life. The identities issued by this CA typically are only valid for a year from the time a device enrolls. If it's just the device identities on individual devices that have expired, you just need to re-enroll them with Profile Manager. If the CA is truly expired, Server should have renewed it.

There is a bug I've seen with Profile Manager where it doesn't automatically re-enroll devices as their device identities approach expiration. It appears to have been fixed in Server 5.7.1, but it's definitely a problem in 5.6.3 and earlier. I use this command every month to workaround the problem:

sudo -u _devicemgr psql -U _devicemgr -d devicemgr_v2m0 -h /Library/Server/ProfileManager/Config/var/PostgreSQL -c "update devices set hp_singleton_tasks = hp_singleton_tasks | (1 << 20) where last_mdm_refresh_ttl_days < 90"

This won't fix those devices with already-expired device identities, but it will help prevent other devices from letting their device identities expire.