ca.key, ca.csr & ca.crt (self generated) are created in Redhat 6.4 with default permissions 644. Is there any reason these are being created with world readable permissions ?

I would imagine to be secure it should be 600.

The openssl tool set doesn't worry about permissions as it is available for several platforms. It's up to the admin to set up proper permissions. 600 is recommended for the private key but 644 can be the public key permissions.

You might be thinking about ssh, which does care about file-permissions (in that, if the permissions on the file are "too permissive," it won't recognize it). I don't think that SSL does that ...

As far as I know, though, none of these files contain "secret" information. They are generated using secret information, in each case held only by one of the two parties, but "they are not secret themselves ... and that is the point." The purpose of the whole thing, as I understand it, is: "I can generate it (you can't) ... you can sign it (I can't) ... I can verify the signature and can't alter what has been signed."

Working together, each party revealing none of its secrets (but employing those secrets), the key exchange can be accomplished, using files that do not have to be kept secret or conveyed across a secure channel. And that's the essential reason for the entire contretemps.

1 members found this post helpful.

"ca.key, ca.csr & ca.crt" is not part openssh but appear to be of SSL public key infrastructure. The files in OpenSSH which you're referring about permissions is mentioned in the openssh FAQ (namely authorized_keys, .ssh, and user $HOME). The names the OP refers to appear to be x509 certificates. While OpenSSL (and SSL in general) does not require any special permissions to operate correctly it is *recommended* that any keys (*.key) be 600 permissions (not required). Public certificates(*.crt) and certificate signing requests (*.csr) do not matter so much about the permissions because they're intended to be publicly distributed.

1 members found this post helpful.

Yes. Exactly my point. It's easy to confuse the two. Very easy.

Ah, I get what you mean now. I thought you had confused it haha. Confusion all around!

Thanks to both of you for your replies.

I know you solved it. But just an interesting thing if you want to properly sign certificates and use https

http://codeghar.wordpress.com/?s=sig...&submit=Search

You setup your own ca and sign keys using only openssl. I kow there are different solutions which are better, but just for a handful of internal certs i quite like that setup.

Thanks.