Currently, we leave all the expired objects no longer referenced from the configuration in the state_path. This includes any certificates that were removed from the config or modified in a way that cache name has changed (it is a hash of all the identifiers + key type).
We should schedule a background task that checks if the cached certificates are referenced from the current configuration and still valid, and removes the files otherwise.
ngx_path_t seem to already offer callbacks for such tasks.