up vote 1 down vote favorite
1
share [g+] share [fb]

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/

This answer adds that the certificate should go in /etc/ssl/certs/ but that seems like an unsafe place. Do .crt files need to be kept safe or are they considered public?

link|improve this question
100% accept rate
feedback

2 Answers

up vote 2 down vote accepted

The .crt file is sent to everything that connects; it is public.

To add to the private key location; make sure you secure it properly as well as having it in there. (chown root:ssl-cert and chmod 640)

link|improve this answer
feedback
up vote 0 down vote

There's not really an unsafe place if permission for the individual files/directory is set to something like chown root :0 private.key and chmod 600 private.key so that only root can read it. CSRs and certificate files are less sensitive as you say.

With those permissions the paths you mention and /usr/local/ssl should be fine.

link|improve this answer
Often, applications accessing private keys are running as non-root users. I'd suggest maintaining access for the ssl-cert group. – Shane Madden Apr 13 '11 at 16:12
Understood but web servers like Apache spawn a root 'parent' process and assuming nginx too this is pertinent. – Jonathan Ross Apr 13 '11 at 16:19
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.