- add /var/lib/certmaster/certmaster* to spec and set perms