Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Where do you usually store SSL certificates on your server ?

  • who are the user and group owners of the certificates folder
  • what are the folder permissions


share|improve this question
up vote 2 down vote accepted

I tend to store them in /etc/pkti/tls/certs (it's a CentOS box); the directory is 755 root:root, and the certificates themselves are 644 root:root. The keyfiles are 600 root:root; that has to be considered enough protection, since if users can read a single file that's 600 root:root the system is compromised.

But I'd like to add a reminder that certificates are not secrets; they're given willy-nilly to everyone who connects to your SSL service ports, as they should be. They should be protected against users writing to them, but not from reading.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.