Implement some validity period for requests from Cert-API. I.e. include timestamp of the request in the queue and do not generate a certificaet for a device when the request is older than several tens of seconds. The Certgen client give-up the request in 30-40 seconds anyway and every request could potentially generates a new certificate. If the CA process stuck or anything similar gets wrong, there are lot of useless requests in the queue and CA generates a unusable certificates in the db.