unset doesn't like @ to silent it, just check if it's set  before unset
Add curly brackets here to improve readability
use email from CA creation also as the default for server cert
tls-verify requires quotes around the command to be executed. Ticket #3596