optimize the query to select the first n serial numbers of expired certificates
add loadtest to enroll certificates according to a template file