How to secure SSl certificates on a server

Question

Where do you usually store SSL certificates on your server ?

• who are the user and group owners of the certificates folder
• what are the folder permissions

Thanks

Answer 1

I tend to store them in /etc/pkti/tls/certs (it's a CentOS box); the directory is 755 root:root, and the certificates themselves are 644 root:root. The keyfiles are 600 root:root; that has to be considered enough protection, since if users can read a single file that's 600 root:root the system is compromised.

But I'd like to add a reminder that certificates are not secrets; they're given willy-nilly to everyone who connects to your SSL service ports, as they should be. They should be protected against users writing to them, but not from reading.