I have a private SSL key on my VPS that's used by several applications (Apache, Postfix, etc). The problem is, I can't exactly set the permissions to 0600 (-rw-------) because these various applications run as different users (www-data, vmail, etc). Oddly enough, Apache is somehow able to read it, but Postfix was bombing out whenever I'd try to send mail through SSL port 465, and I found out it's because of permissions on the key.

Is there a security convention on how to handle this? Do I just make duplicate copies of this SSL key and put it in different places, chowning it to each user/group that needs to use it?

  • 1
    If you protected your private key with a (good) password then I think it wouldn't be too big of a risk to even give other read access.
    – Mxx
    Commented Apr 5, 2013 at 7:08

1 Answer 1


There are few ways to handle it. First I need to mention that only other access is typically prohibited by all programs that need to read keys - in other words, permissions like 640 (rw-r-----) is typically ok.

With this in mind, some methods:

  1. Make certificate fully owned by some program, say apache: www-data:www-data, and with permissions 640. Make some other programs that need to read certificate to be members of www-data group. This is probably most convenient but least secure method as it potentially opens unwanted privileges to processes that did not have it originally.

  2. Make certificate owned by apache, but in vmail group, :www-data:vmail, and permissions 640. This way, apache can read it as owner, and vmail can read it as group member. This is a bit more secure, but does not scale beyond 2 programs.

  3. Make a script to copy original certificate into few targeted ones and change permissions appropriately for each one. This approach is probably most secure and scales well, but creates copies. And no, you cannot create hard-links, because all hard-linked files share owners and permissions.

  • For a tiny bit of additional security above and beyond option #3, you can put all of them in one directory and make that directory 0751 root:root. This will prevent non-root users from directly accessing even the list of files, although obviously the files will still be named in each application's configuration. It really is security by oscurity, but when used in concert with other security measures, even if it doesn't help very much it doesn't break any security. (I do something very similar with my slave DNS, because no ordinary user has any reason to meddle with that zone data anyway.)
    – user
    Commented Apr 5, 2013 at 9:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .