Is it possible to have httpd fail a configtest if a SSLCertificateKeyFile value exists, and points to a file with any permissions other than the minimum necessary for reading the key? I have httpd
running as root
initially, and switching to a different user after startup. The private key file should be owned by root
with group root
and permissions 400. Anything more permissive should cause a warning or startup failure.
The ssh
client has behavior similar to this; if you try to use a private key whose permissions are too open, it fails.
/etc
) rather than each user's directory. Some Linux distributions (e.g. Debian) have/etc/ssl/private/
in mode 710, owned byroot:ssl-certs
, which is rather sensible as a starting point.