use temp file in client

freshcerts-client

@@ -20,10 +20,11 @@ AUTH_TOKEN="$5"
 KEY_PATH="${KEYS_DIRECTORY}/${DOMAIN}.key.pem"
 
 curl -f "${FRESHCERTS_HOST}/v1/cert/${DOMAIN}/should_reissue" 2>/dev/null && \
-	openssl genrsa -out "$KEY_PATH" 2048 2>/dev/null && \
-	openssl req -new -batch -subj "$SUBJ" -key "$KEY_PATH" -out /dev/stdout | \
+	openssl genrsa -out "$KEY_PATH.new" 2048 2>/dev/null && \
+	chmod 0400 "$KEY_PATH.new" && \
+	openssl req -new -batch -subj "$SUBJ" -key "$KEY_PATH.new" -out /dev/stdout | \
 	curl -s -X POST "${FRESHCERTS_HOST}/v1/cert/${DOMAIN}/issue" \
 		-F "csr=@-" -F "ports=$PORTS" -F "domain=$DOMAIN" -F "token=$AUTH_TOKEN" | \
 	tar -C "$KEYS_DIRECTORY" -xf - && \
-	chmod 0400 "$KEY_PATH" && \
+	mv "$KEY_PATH.new" "$KEY_PATH" && \
 	sh -c "$RELOAD_CMD"