# Best practice for exposing private key to locally installed programs? **URL:** \ **Category:** Server\ **Created:** [March 8, 2019, 2:45am UTC](https://community.letsencrypt.org/t/best-practice-for-exposing-private-key-to-locally-installed-programs/88158 "2019-03-08T02:45:40Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![julianlam](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/julianlam/32/27852_2.png) [@julianlam](https://community.letsencrypt.org/u/julianlam)\ **Post date:** [March 8, 2019, 2:45am UTC](https://community.letsencrypt.org/t/best-practice-for-exposing-private-key-to-locally-installed-programs/88158/1 "2019-03-08T02:45:40Z")
Hi all, I have a quick question. `/etc/letsencrypt/live` is set 0700 and so apps can’t read the key (e.g. fluentd, which starts as `td-agent` user). What is the best practice to expose the cert and private key to fluentd and other similar apps? For example, nginx can read `/etc/letsencrypt/live` because the master process is run by root, but fluentd/td-agent starts itself under `td-agent`, and so it does not have read access to the certificates/private keys. I was thinking I could create `ssl` user group and add `td-agent` to that group, then change `/etc/letsencrypt` to be owned by `ssl` group, but I am not sure if this is recommended. I was wondering what others thought or had done in the past… thanks! ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [March 8, 2019, 2:56am UTC](https://community.letsencrypt.org/t/best-practice-for-exposing-private-key-to-locally-installed-programs/88158/2 "2019-03-08T02:56:14Z")
`--deploy-hook` to make a copy of the certificate and private key with suitable permissions. Or filesystem ACLs: ``` setfacl -R -m u:td-agent:rX /etc/letsencrypt/{live,archive}/example.org ``` Don’t change the group/owner of `/etc/letsencrypt`. ---
**Author:** ![julianlam](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/julianlam/32/27852_2.png) [@julianlam](https://community.letsencrypt.org/u/julianlam)\ **Post date:** [March 8, 2019, 2:59am UTC](https://community.letsencrypt.org/t/best-practice-for-exposing-private-key-to-locally-installed-programs/88158/3 "2019-03-08T02:59:34Z")
Well that was fast. Thanks for the speedy reply, I’ll look into those options ASAP. Changing permissions or groups already raised a bunch of flags in my head which is why I wanted to ask and see how others tackled this issue. **Edit** : Took a bit of time to understand what all those flags mean. I also had to run `setfacl -m u:td-agent:rX /etc/letsencrypt/{live,archive}` as that is the directory that `td-agent` had trouble getting into. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [March 8, 2019, 3:27am UTC](https://community.letsencrypt.org/t/best-practice-for-exposing-private-key-to-locally-installed-programs/88158/4 "2019-03-08T03:27:46Z")
> [@julianlam](#): > > I also had to run Nice catch - admittedly I'm running with a very open `rX` on the entire `/etc/letsencrypt` hierarchy 😨. ---
**Author:** ![julianlam](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/julianlam/32/27852_2.png) [@julianlam](https://community.letsencrypt.org/u/julianlam)\ **Post date:** [March 8, 2019, 3:46pm UTC](https://community.letsencrypt.org/t/best-practice-for-exposing-private-key-to-locally-installed-programs/88158/5 "2019-03-08T15:46:52Z")
In case this topic becomes searchable and others find this helpful, I need to clarify: The commands to run are: - `setfacl -R -m u:td-agent:rX /etc/letsencrypt/{live,archive}/example.org`, and then - `setfacl -m u:td-agent:rX /etc/letsencrypt/{live,archive}` You can run them in either order, but it is important that you do not run the latter with `-R` as that would allow the added user (in this case, `td-agent`) read access to any other SSL certificates managed by Let’s Encrypt/Certbot. Thanks @_az for the assist! ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [April 7, 2019, 3:47pm UTC](https://community.letsencrypt.org/t/best-practice-for-exposing-private-key-to-locally-installed-programs/88158/6 "2019-04-07T15:47:00Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.