Generate per-site SSL intermediate CA, fix cred/pki paths

Change-Id: I0bda0791d82142acac8c6af0e152d8d0954ef719
diff --git a/roles/pki-install/handlers/main.yml b/roles/pki-install/handlers/main.yml
index 70b0e2c..4b5cc54 100644
--- a/roles/pki-install/handlers/main.yml
+++ b/roles/pki-install/handlers/main.yml
@@ -1,6 +1,5 @@
 ---
 # pki-install/handlers/main.yml
 
-- name: Run update-ca-certificates on head node
-  become: yes
+- name: update-ca-certificates
   command: update-ca-certificates