Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have my cert.pem and cert.key files in /etc/apache2/ssl folders.

What would be the most secure permissions and ownership of:

1) /etc/apache2/ssl folder

2) /etc/apache2/ssl/cert.pem file

3) /etc/apache2/ssl/cert.key file

(ensuring https:// access works of course :).

thanks

JP

share|improve this question

1 Answer 1

up vote 8 down vote accepted

The directory permissions should be 700, the file permissions on all the files should be 600, and the directory and files should be owned by root.

share|improve this answer
    
Thanks. This works. One thing - I guess the files only need to be read by root that starts the apache daemon. Why do we need to give "write" permissions to the file? –  JP19 Dec 27 '10 at 18:11
5  
The files will need updating periodically, as your certificates expire and need to be renewed, and since there's no real security risk in making them writeable it makes life slightly simpler. They don't need to be readable for day-to-day use, so you can use 400 permissions (and 500 on the directory) if you don't mind having to fiddle with them at renewal time. –  Mike Scott Dec 27 '10 at 18:13
    
cool. thanks for the perfect explanation. –  JP19 Dec 27 '10 at 18:25
    
It should be noted, that the official Apache Docs do not agree with Mike's original suggestions about SSL and go with his second suggestion here in the comments. –  Achmed Durangi Oct 29 '13 at 23:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.