make password optional if opering with certfp