simplified the DEMO scripts
fixed the bug the error occurs if the root CA publishs its own cert before setting any CMP responder
added column sha1_fp_subject to the table cert