1. Use metadata to instead of actual expired time 2. Delete disabled if the certificate was used for a listener Change-Id: I8a16c4c1cc6f104c85835906405aba7ae9a3bf02