Also I think that a unique index on certname would help a lot