moved write to pxy_srccert_create, -X to -w, opts_free use