diff --git a/CHANGELOG.md b/CHANGELOG.md
index 252169b..9fea065 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -32,6 +32,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   images - Fixes [Issue #262](https://github.com/dsccommunity/CertificateDsc/issues/262).
 - Updated pipeline unit tests and integration tests to use Windows Server 2019 and
   Windows Server 2022 images - Fixes [Issue #262](https://github.com/dsccommunity/CertificateDsc/issues/262).
+- Adds logic to exclude certificates which have _already expired_ from being included in the array of 
+  certificates returned from the certificate store, when building a certificate request to be submitted to the PKI.
 
 ### Fixed
 
diff --git a/source/DSCResources/DSC_CertReq/DSC_CertReq.psm1 b/source/DSCResources/DSC_CertReq/DSC_CertReq.psm1
index 42c82a7..ce2c43f 100644
--- a/source/DSCResources/DSC_CertReq/DSC_CertReq.psm1
+++ b/source/DSCResources/DSC_CertReq/DSC_CertReq.psm1
@@ -418,14 +418,15 @@ function Set-TargetResource
         $Subject = "CN=$Subject"
     } # if
 
-    # If we should look for renewals, check for existing certs
+    # If we should look for renewals, check for existing, non-expired certs
     if ($AutoRenew)
     {
         $certs = Get-ChildItem -Path Cert:\LocalMachine\My |
             Where-Object -FilterScript {
                 $_.Subject -eq $Subject -and `
                 (Compare-CertificateIssuer -Issuer $_.Issuer -CARootName $CARootName) -and `
-                    $_.NotAfter -lt (Get-Date).AddDays(30)
+                $_.NotAfter -gt (Get-Date) -and `
+                $_.NotAfter -lt (Get-Date).AddDays(30)
             }
 
         # If multiple certs have the same subject and were issued by the CA and are 30 days from expiration, return the newest