add --fresh parameter to update-ca-cert. and a warning message above that