add option to restrict the CRLs kept in database