pki: make certificates only readable to group and others

even though we copy these to hosts it's not a good idea to allow them to
be overwritten by a random user. Openssl database files are also always
recreated, umask should take care of all of that.

packaging/bin/pki-enroll-openssh-cert.sh

@@ -32,6 +32,7 @@ sign() {
 		}
 		trap cleanup 0
 		cat "${PKIDIR}/private/ca.pem" > "${TMPCA}"
+		umask 0022
 		ssh-keygen \
 			-s "${TMPCA}" \
 			-P "" \

packaging/bin/pki-enroll-request.sh

@@ -22,6 +22,7 @@ sign() {
 		[ -e "${CERT_CONF}" ] || die "${CERT_CONF} is missing, Cannot sign certificate"
 		EXTRA_COMMAND="-extfile ${CERT_CONF} -extensions ${extsection}"
 	fi
+	umask 0022
 	OVIRT_KU="${ovirt_ku}" OVIRT_EKU="${ovirt_eku}" OVIRT_SAN="${ovirt_san}" \
 		openssl ca \
 		-batch \