# SSL key permissions - why does root work?

**URL:** <https://www.ruby-forum.com/t/ssl-key-permissions-why-does-root-work/224981>\
**Category:** NGINX\
**Created:** [December 5, 2012, 6:05pm UTC](https://www.ruby-forum.com/t/ssl-key-permissions-why-does-root-work/224981 "2012-12-05T18:05:52Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\
**Post date:** [December 5, 2012, 6:05pm UTC](https://www.ruby-forum.com/t/ssl-key-permissions-why-does-root-work/224981/1 "2012-12-05T18:05:52Z")

</div>

Hi all–

This might be a silly question, so I apologize, but I would like to know  
the  
answer. When configuring Nginx to work with SSL/TLS, best practice  
appears  
to be to secure your site’s private key by ensuring it’s owned by  
root:root  
and that its permissions are set to 400. My question, though, is why  
does  
this work? The Nginx worker processes, running under their own context,  
can’t access the file that way. Do they rely on the master process  
(running  
as root) to read the key for them?

Thanks!

Posted at Nginx Forum:

> **[SSL key permissions - why does root work?](https://forum.nginx.org/read.php?2,233606,233606#msg-233606)**
>
> Hi all-- This might be a silly question, so I apologize, but I would like to know the answer. When configuring Nginx to work with SSL/TLS, best practice appears to be to secure your site's private key by ensuring it's owned by root:root and that its...

---

<div class="post-metadata">

**Author:** ![pokrface](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e9c0ed/32.png) [@pokrface](https://www.ruby-forum.com/u/pokrface)\
**Post date:** [December 6, 2012, 11:23am UTC](https://www.ruby-forum.com/t/ssl-key-permissions-why-does-root-work/224981/2 "2012-12-06T11:23:23Z")

</div>

Hello!

On Wed, Dec 05, 2012 at 12:05:02PM -0500, pokrface wrote:

> Hi all–
> 
> This might be a silly question, so I apologize, but I would like to know the  
> answer. When configuring Nginx to work with SSL/TLS, best practice appears  
> to be to secure your site’s private key by ensuring it’s owned by root:root  
> and that its permissions are set to 400. My question, though, is why does  
> this work? The Nginx worker processes, running under their own context,  
> can’t access the file that way. Do they rely on the master process (running  
> as root) to read the key for them?

Worker processes doesn’t read keys, but use keys already in memory  
(read by the master process during reading/parsing the  
configuration file, and inherited via fork() syscall, much like  
all other configuration data).

–  
Maxim D.

> **[F5 NGINX: Built for cloud-native apps. Ready for AI traffic.](https://www.f5.com/products/nginx)**
>
> Deliver modern applications with NGINX. Explore high-performance load balancing, API gateways, and web server solutions trusted by top global enterprises.