What is the primary function of a certificate authority?

Expiring outdated certificates is a time-based property encoded into the certificate at issuance via the validity period field - the CA does not actively expire certificates after the fact, though it may revoke them early via CRL or OCSP.

Verifying and validating certificates in use is the role of a relying party's software or an OCSP responder, not the primary function of the CA itself.

Storing security certificates may be an operational task some CA implementations perform as a secondary service, but it is not the defining or primary function that constitutes a certificate authority.

Signing a CSR is the core operation a CA performs - it uses its own private key to sign the applicant's submitted public key and identity information, producing an issued X.509 certificate that relying parties can trust by verifying the CA's signature. This signing act is what grants the resulting certificate its authority within the PKI hierarchy and is the defining purpose that distinguishes a certificate authority from other PKI components.