Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/

This answer adds that the certificate should go in /etc/ssl/certs/ but that seems like an unsafe place. Do .crt files need to be kept safe or are they considered public?

share|improve this question

3 Answers 3

up vote 6 down vote accepted

The .crt file is sent to everything that connects; it is public.

To add to the private key location; make sure you secure it properly as well as having it in there. (chown root:ssl-cert and chmod 640)

share|improve this answer
I wonder why that directory isn't g+s by default. –  Collin Anderson Sep 30 '14 at 17:43

There's not really an unsafe place if permission for the individual files/directory is set to something like chown root :0 private.key and chmod 600 private.key so that only root can read it. CSRs and certificate files are less sensitive as you say.

With those permissions the paths you mention and /usr/local/ssl should be fine.

share|improve this answer
Often, applications accessing private keys are running as non-root users. I'd suggest maintaining access for the ssl-cert group. –  Shane Madden Apr 13 '11 at 16:12
Understood but web servers like Apache spawn a root 'parent' process and assuming nginx too this is pertinent. –  Jonathan Ross Apr 13 '11 at 16:19

Under Ubuntu systems I personally keep mine in /etc/apache2/ssl/private or similar httpd etc created area.

All of this owned by root:

sudo mkdir /etc/apache2/ssl
sudo mkdir /etc/apache2/ssl/private
sudo chmod 755 /etc/apache2/ssl
sudo chmod 710 /etc/apache2/ssl/private

Copy/Move public www ssl certificate(s) to /etc/apache2/ssl

Move private key(s) to /etc/apache2/ssl/private - then:

sudo chmod 755 /etc/apache2/ssl/*.crt
sudo chmod 640 /etc/apache2/ssl/private/*.key

then verify root:ssl-cert owns it all:

sudo chown -R root:ssl-cert /etc/apache2/ssl

(^ owner:group can also be "root:root" - apache/nginx reads as root anyway - you can also do away with any group privilege in this case (private folder = chmod 700 / key file = chmod 600) if you do)


As mentioned, it really doesn't matter where you put your private key(s) as long as you properly protect them.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.