Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up a secure connection (https) in nginx.

But I'm a bit worried about the private key's permissions, which aren't mentioned in any tutorial.

Should I change them? To what?

share|improve this question
up vote 7 down vote accepted

Private keys should have reading heavily restricted. Setting permissions to 600 and owned by root should work. However, there are other secure permissions settings - Ubuntu stores keys in a directory with owner root and group ssl-cert and permissions 710. This means that only members of ssl-cert can access any files in that directory. Private keys then have group ssl-cert, owner root, and permissions 640.

share|improve this answer
    
I'll add, for specificity: When using nginx on CentOS 7, it is not necessary to make either the certificate or the private key readable by those in the nginx group. The webserver will be able to use them even if they are readable only by root (as they should be). – Simon South Jan 2 at 17:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.