Cascade delete of CdnCertificate to the Serial

This way we never end up putting CdnCert serials in the crl.
Probably doesn't make much difference, but this seems cleaner