For migrations it makes sense if the user can read certificates. So he can copy the old certificate to the new server.
This change makes the certificate readable for the Devop user.
Since the certificate is written restrictively by Dehydrated, the permission is changed afterwards via hook.
Closes #680
