Can I disable user certificate? Can I generate new one?

Hi, Here's the case: Let's assume we have configured freeradius to use EAP/TLS. CA and server certificates are created, users recieved their .p12 keys and server certs. Now everyone (that has theese files of course) can access our wireless network. 1) What if - for some reason - I want to disallow certain user from having access? He already has the files he needs installed on his machine. I can set Expiration attribute, but is there any other way? 2) What if I need to generate a new certificate for the same user? Let's say someone gained access to his computer and stole the certificate and the key? Can I generate a new certificate for the same user and disable the old one he had? Regards, Peter