Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Where do you usually store SSL certificates on your server ?

  • who are the user and group owners of the certificates folder
  • what are the folder permissions

Thanks

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

I tend to store them in /etc/pkti/tls/certs (it's a CentOS box); the directory is 755 root:root, and the certificates themselves are 644 root:root. The keyfiles are 600 root:root; that has to be considered enough protection, since if users can read a single file that's 600 root:root the system is compromised.

But I'd like to add a reminder that certificates are not secrets; they're given willy-nilly to everyone who connects to your SSL service ports, as they should be. They should be protected against users writing to them, but not from reading.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.