The current CS.cfg contains the cert requests of the subsystem certificates. The cert requests are actually also stored in the database, so the copies in the CS.cfg are redundant.

To remove redundancy, the cert requests should be obtained directly from the database. There should be an interface to find the cert request of a given cert, for example:

$ pki <agent auth> ca-cert-request-find --cert cert.pem

Once the new interface is implemented, all codes should be converted incrementally to use the interface. Once everything is converted, the redundant cert requests can be removed from CS.cfg.