public-ssl-cert: change permissions only on file creation

roles/public-ssl-cert/tasks/main.yml

@@ -19,9 +19,11 @@
   shell: "openssl req -x509 -newkey rsa:2048 -keyout /etc/credentials/public/{{ cn }}/privkey.pem -nodes -out /etc/credentials/public/{{ cn }}/fullchain.pem -days 3650 -subj '/CN={{ cn }}'"
   args:
     creates: "/etc/credentials/public/{{ cn }}/fullchain.pem"
+  register: ssl_cert_selfsigned
 
 - file:
     path: "/etc/credentials/public/{{ cn }}/privkey.pem"
     owner: root
     group: public-credentials
     mode: 0440
+  when: ssl_cert_selfsigned.changed