Should there be a unique constraint on "certname", given that each host only maps to a single catalog? I'm also wondering if "hash" is similarly unique.