It looks like if there is a key already, the script uses existing key to generate the CSR. Since the existing key was only 1024 bit, the CSR was only 1024 bit.
-renamed the existing key.
-re-run the script.
-CSR created correctly.
Thanks for response.