Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In an environment where a handful of Apache servers are running a bunch of sites using SSL certificates for HTTPS, where should these certificates be placed? In Debian or Ubuntu, should all relevant files be put in /etc/apache2/ssl? Or is there some other location better suited for this? What security concerns should be addressed when choosing locations for these files for multiple websites on the same server?

share|improve this question

2 Answers 2

FWIW, I use Debian.

I place all private keys in /etc/ssl/private which has permission mode 0700. I place all certificates in /etc/ssl/certs which has permission mode 0755. The owner/group for both is root:root.

share|improve this answer

Basically, your SSL key files should be readable only by a root user (you should issue two commands on them: sudo chown root:root /path/to/your/keyfile.key and sudo chmod 600 /path/to/your/keyfile.key). Your certificate files can be world-readable. And it's always a good idea to keep your keys and certificates outside your web-accessible document tree, /etc/apache/ssl should work well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.