host-del and service-del are slow because cert revokation is implemented inefficiently. The internal cert_find() call retrieves all certificates from Dogtag. The workaround special cases service and host find without additional RA search options. A search for service and host certs limits the scope to certificate with matching subject common name. See: https://pagure.io/freeipa/issue/7835 Signed-off-by: Christian Heimes <cheimes@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>