[DOCS] Improve docs for "--pass" option in certutil (elastic/x-pack-elasticsearch#4352)

The handling of the "--pass" option has complex rules due to the
different requirements of different output formats, and the way
joptsimple handles specs with optional arguments.

A standard unix shell will parse
    certutil --pass=""
as being identical to
    certutil --pass=
and joptsimple treats that as being "no argument", i.e. the same as
    certutil --pass

The only way to pass a blank password is
    certutil --pass ""
(though this is shell dependent)

Original commit: elastic/x-pack-elasticsearch@bc09d0f298

docs/en/commands/certutil.asciidoc

@@ -173,6 +173,15 @@ with the `ca` parameter.
 `--out <file_path>`:: Specifies a path for the output files.
 
 `--pass <password>`:: Specifies the password for the generated private keys.
++
+Keys stored in PKCS#12 format are always password protected.
++
+Keys stored in PEM format are password protected only if the
+`--pass` parameter is specified. If you do not supply an argument for the
+`--pass` parameter, you are prompted for a password.
++
+If you want to specify a _blank_ password (without prompting), use 
+`--pass ""` (with no `=`).
 
 `--pem`:: Generates certificates and keys in PEM format instead of PKCS#12. This
 parameter cannot be used with the `csr` parameter.