Having PRIMARY KEY on certificate.id is to strict -- as real uniques is
required on id + reference in certificate table.