acme module's group parameter is non-functional

[nbraud]

Description of Issue/Question

acme.cert enforces that the private key file is mode 0600, so setting the group ownership using the group option does not actually result in another group being able to read the private key.

Please change the permission to 0640, which is the only sensible default, given that there is a group parameter which defaults to root. Perhaps consider making it configurable.

Setup

somegroup:
  group.present

some.example.com:
  acme.cert:
    - email: webmaster@example.com
    - group: somegroup

Steps to Reproduce Issue

1. Apply that state to a minion.
2. After a successful highstate, confirm that group somegroup cannot read the private key file.

Versions Report

2018.3.2, but looking at the code suggests that it's still present in develop.

$ salt --versions-report
Salt Version:
           Salt: 2018.3.2
 
Dependency Versions:
           cffi: 1.10.0
       cherrypy: 3.2.2
       dateutil: 2.1
      docker-py: Not Installed
          gitdb: Not Installed
      gitpython: Not Installed
          ioflo: Not Installed
         Jinja2: 2.7.2
        libgit2: Not Installed
        libnacl: Not Installed
       M2Crypto: Not Installed
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.4.6
   mysql-python: Not Installed
      pycparser: 2.18
       pycrypto: 2.6.1
   pycryptodome: Not Installed
         pygit2: Not Installed
         Python: 2.7.14 (default, May  2 2018, 18:31:34)
   python-gnupg: Not Installed
         PyYAML: 3.10
          PyZMQ: 14.5.0
           RAET: Not Installed
          smmap: Not Installed
        timelib: Not Installed
        Tornado: 4.2.1
            ZMQ: 4.0.5
 
System Versions:
           dist:   
         locale: UTF-8
        machine: x86_64
        release: 4.14.51-60.38.amzn1.x86_64
         system: Linux
        version: Not Installed

[AstraLuma]

Specifically https://github.com/saltstack/salt/blob/v2018.3.2/salt/modules/acme.py#L183 where the mode is hard-coded.

[Ch3LL]

Thanks for the PR! As it looks like your PR does indeed fix the issue I will close this issue and keep the conversation in the PR but let me know if this needs to be re-opened.