The CLI command "bin/ejbca.sh ca republish" does:

1. List all username from the UserData table, where the cAId column in userdata matches the CA you want to republish
   (it will print some info about the users it find when republishing)
2. It gets the certificate profile ID from the entry in UserData (certificateProfileId column)
3. It gets the active publisher(s) from the Certificate Profile this certificateProfileId points to (for this username)
4. It gets all certificates for this username from the CertificateData table
5. It publishes the certificates retrieved in step 4 to the publishers from step 3.

Listing usernames may not always produce the desired result, because end entities can be removed and edited. Nowadays we can get certificate profiles ID from the CertificateData entry directly (this was not possible a long time ago which is probably why the command works as it does).