I created a program that gets the Let’s Encrypt certificates for my services (web sites, dovecot and smtp).

I previously stored these service certificates in /etc/ssl/certs (I’m on Debian), and just found that this is a bad idea. This directory is for root certificates.

Let’s Encrypt stores certificates and private keys in a directory named /etc/letsencrypt/live. These are renewed every two to three months.

Is it a good idea to store such type of files in a sub-directory of /etc ? Shouldn’t they be stored in /var since they are modifying data ? /var/local perhaps ?


Reading this explanation on /var/lib and this answer was very helpful.

It appears that the right place to store certificates and private keys generated and renewed by my program is in /var/lib/<program-name> with sub-directories certs and private.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.