Ensure new certificates are readably by ssl-cert group members.

states/certificates/dehydrated/hooks/deploy.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 #
 # Copy dehydrated generated certs into /var/local/certificates and
-# set required ownership. Also restart local services as appropriate.
+# set required ownership and permissions. Also restart local services
+# as appropriate.
 
 action=$1
 shift
@@ -9,6 +10,8 @@ shift
 deploy_cert() {
     cp -a /var/lib/dehydrated/certs/* /var/local/certificates/
     chown -R root:ssl-cert /var/local/certificates/
+    find /var/local/certificates/ -type d -print0 | xargs -0 chmod g+rx
+    find /var/local/certificates/ -type f -print0 | xargs -0 chmod g+r
 
     DOMAIN="$1"
     case $DOMAIN in