{"record":{"id":"6c07ec4d05647299","repo":"quarkusio/quarkus","slug":"failed-to-set-private-key-file-readable-by-owner-o","errorCode":null,"errorMessage":"Failed to set private key file readable by owner only. This is a critical security requirement to protect the private key.","messagePattern":"Failed to set private key file readable by owner only\\. This is a critical security requirement to protect the private key\\.","errorType":"exception","errorClass":"SecurityException","httpStatus":null,"severity":"critical","filePath":"extensions/tls-registry/cli/src/main/java/io/quarkus/tls/cli/letsencrypt/LetsEncryptHelpers.java","lineNumber":325,"sourceCode":"        }\n        if (!certFile.setWritable(true, true)) {\n            LOGGER.error(\"Failed to set certificate file writable by owner only\");\n        }\n\n        // Private key MUST be owner-only readable/writable (chmod 600)\n        if (!keyFile.setReadable(false, false)) { // Remove group/world read\n            LOGGER.warnf(\"Failed to set key file readable only by the owner: %s\", keyFile.getAbsolutePath());\n        }\n        if (!keyFile.setWritable(false, false)) { // Remove group/world write\n            LOGGER.warnf(\"Failed to set key file writable only by the owner : %s\", keyFile.getAbsolutePath());\n        }\n        if (!keyFile.setExecutable(false, false)) { // Remove group/world execute\n            LOGGER.warnf(\"Failed to set key file executable by owner only: %s\", keyFile.getAbsolutePath());\n        }\n\n        // Then set owner-only permissions\n        if (!keyFile.setReadable(true, true)) { // Owner-only read\n            throw new SecurityException(\"Failed to set private key file readable by owner only. \" +\n                    \"This is a critical security requirement to protect the private key.\");\n        }\n        if (!keyFile.setWritable(true, true)) { // Owner-only write\n            throw new SecurityException(\"Failed to set private key file writable by owner only. \" +\n                    \"This is a critical security requirement to protect the private key.\");\n        }\n\n        AUDIT.debug(\"Set secure permissions on private key file: \" + keyFile.getAbsolutePath() + \" (owner-only: rw-------)\");\n        LOGGER.debug(\"Set secure permissions on private key file (owner-only: rw-------)\");\n    }\n}\n","sourceCodeStart":307,"sourceCodeEnd":337,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/cli/src/main/java/io/quarkus/tls/cli/letsencrypt/LetsEncryptHelpers.java#L307-L337","documentation":"adjustPermissions() hardens the private key file by removing execute for all and restricting read to the owner only via File.setReadable(true, true). If the OS refuses to apply owner-only read permission, a SecurityException is thrown because leaving the key world-readable is considered an unacceptable security risk. The method deliberately fails closed rather than continuing with loose permissions.","triggerScenarios":"keyFile.setReadable(true, true) returns false — occurs when the file is on a filesystem that does not support POSIX permissions (Windows NTFS/FAT, some network mounts, container volumes), when the process user is not the file owner, or when setReadable threw/failed due to SecurityManager restrictions.","commonSituations":"Running the CLI on Windows where owner-only permissions cannot be expressed, working directory on a mounted share (SMB/NFS) with permission mapping issues, running as a different user than the one that created the key file, or a SecurityManager denying file attribute changes.","solutions":["Run the command as the user who owns the key file (or chown the file to the current user)","Move the letsencrypt directory to a local POSIX filesystem (e.g. ext4) instead of a network share or Windows volume","Verify parent directory permissions allow modifying the file, then retry renewal","If on a platform without POSIX perms, ensure the environment guarantees isolation (container with restricted volume) before accepting the limitation"],"exampleFix":"// before\nFile keyFile = new File(\"/mnt/nfs/letsencrypt/site.key\"); // NFS mount, perms not enforceable\n// after\nFile keyFile = new File(\"/var/lib/quarkus/letsencrypt/site.key\"); // local POSIX fs","handlingStrategy":"validation","validationCode":"static boolean canSecureKeyFile(File f) {\n    try {\n        return f.isFile() && f.canWrite()\n            && Files.getFileAttributeView(f.toPath(), PosixFileAttributeView.class) != null\n            && Files.getOwner(f.toPath()).getName().equals(System.getProperty(\"user.name\"));\n    } catch (IOException e) { return false; }\n}","typeGuard":"if (!Files.getFileAttributeView(keyFile.toPath(), PosixFileAttributeView.class).readAttributes().permissions().contains(PosixFilePermission.OWNER_READ)) { relocateFilesystem(); }","tryCatchPattern":"try {\n    LetsEncryptHelpers.adjustPermissions(keyFile);\n} catch (SecurityException e) {\n    LOGGER.error(\"Cannot enforce owner-only permissions on \" + keyFile + \"; move to a local POSIX filesystem\", e);\n    throw new IllegalStateException(\"Refusing to store private key without owner-only permissions\", e);\n}","preventionTips":["Keep key material on a local POSIX filesystem, never Windows/NFS/FAT mounts","Run the CLI as the same user that owns the letsencrypt directory","Pre-create the directory with 700 so inherited file permissions are sane","Check for SecurityManager/policy files that could block File permission changes"],"tags":["security","file-permissions","private-key"],"backgroundTag":"file-permission-denied","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}