In order to change a certificate to default, use the TSS REPLACE command. A keyring can only have one DEFAULT certificate, so if you issue the TSS REPLACE to make a different certificate the default and then refresh the acid, it should remove the DEFAULT from the first acid. The command would be similar to below:
TSS REPL(owner_acid) KEYRING(keyring) RINGDATA(owner,cert) DEFAULT USAGE(PERSONAL)