Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On Ubuntu, it looks like the best place for a private key used to sign a certificate (for use by nginx) is in /etc/ssl/private/

This answer adds that the certificate should go in /etc/ssl/certs/ but that seems like an unsafe place. Do .crt files need to be kept safe or are they considered public?

share|improve this question
You can put your .crt up on a Times Square billboard, if you like. – ceejayoz Jul 5 at 17:57
up vote 20 down vote accepted

The .crt file is sent to everything that connects; it is public. (chown root:root and chmod 644)

To add to the private key location; make sure you secure it properly as well as having it in there. (chown root:ssl-cert and chmod 640)

share|improve this answer
I wonder why that directory isn't g+s by default. – Collin Anderson Sep 30 '14 at 17:43
It doesn't need to be; the directory is 0750, so there's no way for any users not in the group to traverse into the directory to read the files. – womble Aug 12 '15 at 20:52
For most of the applications I use, I see the behavior as described in the linked answer: they use the user root to load the certificate. But the permissions here are well explained. – SimonSimCity Jan 7 at 10:36

For Apache web server SSL personally keep mine in /etc/apache2/ssl/private or a similar user created area under httpd/apache configuration in /etc. (The default area is normally /etc/ssl - see bottom of this answer for more.)

This post is geared toward Ubuntu+Apache/OP, but should work on most systems, but note the notes.

Create directories:

sudo mkdir /etc/apache2/ssl
sudo mkdir /etc/apache2/ssl/private
sudo chmod 755 /etc/apache2/ssl
sudo chmod 710 /etc/apache2/ssl/private

chmod 710 supports ssl-cert group under Ubuntu.
Setting permission to '700' on /etc/apache2/ssl/private will also work.

sudo chown -R root:root /etc/apache2/ssl/
sudo chown -R root:ssl-cert /etc/apache2/ssl/private/

If you do not have ssl-cert group, just use 'root:root' for everything. (^ignore the 2nd line).

Put public www ssl certificate(s) along with intermediate certificate(s) in /etc/apache2/ssl
Put private ssl key(s) in /etc/apache2/ssl/private

Then set permissions:

Public Certificate(s)

sudo chmod 644 /etc/apache2/ssl/*.crt

Private Key(s)

sudo chmod 640 /etc/apache2/ssl/private/*.key

Note: The group permission is set to READ due to ssl-cert group. '600' should also work fine.

Now edit any web server '.conf' files and where they point for SSL as needed.

sudo nano /etc/apache/sites-enabled/mysiteexample-ssl.conf

Restart web service.

sudo service apache2 restart


sudo systemctl restart apache2.service


As mentioned, it really doesn't matter where you put your private key(s) as long as you properly protect them.

NOTE: I do not use the default location /etc/ssl in above example. It's easier for me to keep all mine in a separate area. You can view the Apache default ssl configuration ("cat /etc/apache2/sites-available/default-ssl.conf") as a good example of default directories normally used under a simple Ubuntu Apache/SSL install. It points to SSL certificates,keys,bundles,etc, as well as common directives used for a given SSL site. The Default /etc/ssl area should already be protected correctly as installed.

share|improve this answer
not sure why you would suggest setting 710 for permissions for /etc/apache2/ssl/private. Setting the execute bit for the directory (for the group) without setting the read bit for the directory (for the group) doesn't make a lot of sense to me. Did you mean to set it as 750? – chriv Mar 22 at 18:09
@chriv I just set permissions based on how I see it setup under Ubuntu default SSL area. See /etc/ssl/certs & /etc/ssl/private & ssl-certs group use. See – bshea Jun 11 at 23:31

There's not really an unsafe place if permission for the individual files/directory is set to something like chown root :0 private.key and chmod 600 private.key so that only root can read it. CSRs and certificate files are less sensitive as you say.

With those permissions the paths you mention and /usr/local/ssl should be fine.

share|improve this answer
Often, applications accessing private keys are running as non-root users. I'd suggest maintaining access for the ssl-cert group. – Shane Madden Apr 13 '11 at 16:12
Understood but web servers like Apache spawn a root 'parent' process and assuming nginx too this is pertinent. – Jonathan Ross Apr 13 '11 at 16:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.