Match the permissions of the private key.

In the renew-certs playbook the permissions are 444, but 644 in the
debian_server role. Settle on 444.

roles/debian_server/tasks/main.yml

@@ -177,7 +177,7 @@
 
 - name: Make sure the private key is accessible
   file:
-    mode: 0o0644
+    mode: 0o0444
     path: /var/ssl/site.key
     state: file