use yes to blank the openssl csr