1

I am curious about what should be the file permission of the ssl certificate files. Because you really don't want anyone physically copying the server key, so why does the hosts make it readable to everyone? (644)

1

This is partially subjective and especially because your question lacks too many points of context like: which applications are using these certificates, which OS (based on your mention of 644 it seems you speak about Unix systems - in which case saying rw-r--r-- seems far more readable to me - but there are other OS out there), which level of security, etc.

So let us go back a little. For typical HTTPS PKI operations a server needs to have one certificate (per virtual host typically) which is bascially the public part of a key and, separately, the private key file. We will often see these called: the certificate and the key.

Personal pet peeve diversion: stop saying "SSL certificate", even if everyone does it, as it is a double errors. First, SSL does not exist anymore, we do TLS nowadays. And then it is really a X.509 certificate used for TLS communications, as you could do TLS without certificates at all or TLS with other key materials than X.509 certificate, so these two things are independent in fact.

The certificate is public by definition. So it can be made available to anyone, that is "world readable". As any other file I would however make sure that it is not owned (nor the directory in which it resides) by the same UID under which the webserver runs.

As for the key, by definition, it is private. Its Unix rights should be as small as possible, based on other constraints. If it is owned by same UID as the webserver (not the case I recommend), it can be r--------; otherwise a sensible option would be to make it owned by root or some other admin account and create a group for the webserver so that the rights could be rw-r-----.

  • Its a hosted site. I want the private key (server key) not readable to the public. Otherwise, they copy it, then they install it on a different machine, then that machine ties my bandwidth up on the web server. What is wrong with the system itself is there is no way it can be tied to just one machine (like it should be on web hosting sites) if needed. – drtechno Jul 2 '18 at 22:41
  • @drtechno like I said in my answer, the private key should be readable only by the webserver account, and not stored in the content exposed through HTTP of course. That way, I do not see how it can be copied, except if your users have shell access to the box and have extended rights or having the webserver running under their user account. Of course the private key should not be accessible from the public! The certificate is tied to one machine because it is tied to the key which should be private and specific to one machine and no others. – Patrick Mevzek Jul 2 '18 at 23:00
  • They did found their way in somehow through some sort of xml or php exploit or the apachie exploit, all three are on youtube on how to do this on anybody's site. A friend has a site hosted on amazon, and they attacked his site so bad that anyone who would go to it would see a "certificate error" and in the explanation of the error displayed all Keys (public and private) – drtechno Jul 2 '18 at 23:06
  • @drtechno Yeah "some sort of".... of course if things are misconfigured various attacks exist. Retrieving the certificate is not a problem, it is public, anyone gets it once they connect through HTTPS. As for the key, if only the webserver can read it and it is not stored in the area served under HTTP and you do not have applications launched by the webserver that can be subverted then the key is safe. Other solutions: protect it with a password (but you will need to enter it at each webserver start) and/or run applications as separate accounts from the webserver one. – Patrick Mevzek Jul 2 '18 at 23:32
  • the whole thing gets me as its a simple html page site (a 100K page). I didn't have any time to transfer a whole website before my bandwidth was sucked from my webserver's Internet connection (5GB of bandwidth was consumed). The only thing I did to the security was to enable hotlink protection. – drtechno Jul 2 '18 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.