add option "-ca" to specify CA to which the enroll request will be sent