23

I'm trying to set up a secure connection (https) in nginx.

But I'm a bit worried about the private key's permissions, which aren't mentioned in any tutorial.

Should I change them? To what?

2 Answers 2

23

Private keys should have reading heavily restricted. Setting permissions to 600 and owned by root should work. However, there are other secure permissions settings - Ubuntu stores keys in a directory with owner root and group ssl-cert and permissions 710. This means that only members of ssl-cert can access any files in that directory. Private keys then have group ssl-cert, owner root, and permissions 640.

2
  • 5
    I'll add, for specificity: When using nginx on CentOS 7, it is not necessary to make either the certificate or the private key readable by those in the nginx group. The webserver will be able to use them even if they are readable only by root (as they should be).
    – user369080
    Jan 2, 2016 at 17:49
  • Just to recap: the private key(s) can be owned by root with 600 (or even 000 for that matter) when NGINX is started as root, because the master process will act as root and only the worker processes are started as the specified system user (e.g., with the user directive). Right? (edit: I got my answer in the next answer.)
    – toraritte
    Aug 31, 2023 at 17:45
7

I had an issue getting nginx setup and came across this question. The other answer here has already directly answered the question but I thought a little more information would be helpful.

Normally, nginx is started as the root user by init scripts / systemd. However, nginx also has the ability to switch to a less privileged user for normal operations. So my question was which user is used to load the ssl certificate/key? The initial privileged user or the one that is switched to?

Fortunately, nginx uses the initial permissions to read the certificate and key into memory before switching users. So, normally, you really can leave the keys with very restricted permissions as they are loaded by nginx when it's still running as root.


The problem that I was running into that landed me here was that I was defining ssl_certificate only in my server blocks in nginx.conf. I was getting errors like [error] 18606#18606: *311 no "ssl_certificate" is defined in server listening on SSL port while SSL handshaking when I knew darn good and well that my keys were in the right place. That issue was that I didn't have a ssl_certificate at the http level of nginx.conf.

Hope this is helpful for someone.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .