--no-ssl flag no longer makes IsRootRequired true