#1. redo rand generation to adhere to pipefail. #2 give openssl req the subject so it can run unattended