chef: use wildcard cert of chef domain