Replace cp+chown with install

Use fullchain.pem instead of cert.pem which fixes "certificate signed by
unknown authority" problems.
Also point cafile to correct root cert.

global/overlay/etc/puppet/modules/cdn/files/mqtt/sunet-cdn-mqtt

@@ -9,20 +9,13 @@ set -eu
 le_dir="/etc/letsencrypt/live/$(hostname -f)"
 mosquitto_dir="/etc/mosquitto"
 
-le_chain="$le_dir/chain.pem"
+le_fullchain="$le_dir/fullchain.pem"
-mosquitto_chain="$mosquitto_dir/ca_certificates/chain.pem"
+mosquitto_fullchain="$mosquitto_dir/certs/fullchain.pem"
-cp "$le_chain" "$mosquitto_chain"
+install -m 644 -o mosquitto -g root "$le_fullchain" "$mosquitto_fullchain"
-chown mosquitto:root "$mosquitto_chain"
-
-le_cert="$le_dir/cert.pem"
-mosquitto_cert="$mosquitto_dir/certs/cert.pem"
-cp "$le_cert" "$mosquitto_cert"
-chown mosquitto:root "$mosquitto_cert"
 
 le_key="$le_dir/privkey.pem"
 mosquitto_key="$mosquitto_dir/certs/privkey.pem"
-cp "$le_key" "$mosquitto_key"
+install -m 600 -o mosquitto -g root "$le_key" "$mosquitto_key"
-chown mosquitto:root "$mosquitto_key"
 
 # Tell mosquitto to reload certs
 pkill -x -HUP mosquitto

global/overlay/etc/puppet/modules/cdn/templates/mqtt/cdn.conf.erb

@@ -1,6 +1,6 @@
 listener 8883
-cafile /etc/mosquitto/ca_certificates/chain.pem
+cafile /usr/local/share/ca-certificates/step_ca_root.crt
-certfile /etc/mosquitto/certs/cert.pem
+certfile /etc/mosquitto/certs/fullchain.pem
 keyfile /etc/mosquitto/certs/privkey.pem
 require_certificate true
 use_identity_as_username true