[GH-ISSUE #421] Handling of TLS cert key file #215

Closed
opened 2026-02-26 10:31:02 +03:00 by kerem · 1 comment
Owner

Originally created by @bluesky-ca on GitHub (Mar 23, 2022).
Original GitHub issue: https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/421

Not sure if this is a bug or a documentation issue - in general the TLS certificate should be 400 owned by root - the process should read it before it drops the root priv. - based on the default documentation if the cert dir is under the data ie an explicit -e value for the path is not used, the startup script /app/ds/run-document-server.sh runs chown and chmod which changes the key file to 755.

# change folder rights for i in ${LOG_DIR} ${LIB_DIR} ${DATA_DIR}; do chown -R ds:ds "$i" chmod -R 755 "$i" done

If I set the key to be 400 owned by root, and located it outside the data dir, and point to it with -e SSL_KEY_PATH will nginx be able to read it ? Looking at the ps output, the master nginx process is root.

The part I am not sure about, what is a good location as I want to keep it outside the container and it cannot be in log, lib or data as the chmod operates on all of them - if this has been documented please post a link to the guide.

All the setup guides I have seen just mention to change the key file to 400 - many people may not run ls -l after the docker restart to see that the key file is now 755 and owned by the ds user.

Originally created by @bluesky-ca on GitHub (Mar 23, 2022). Original GitHub issue: https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/421 Not sure if this is a bug or a documentation issue - in general the TLS certificate should be 400 owned by root - the process should read it before it drops the root priv. - based on the default documentation if the cert dir is under the data ie an explicit -e value for the path is **not** used, the startup script /app/ds/run-document-server.sh runs chown and chmod which changes the key file to 755. `# change folder rights for i in ${LOG_DIR} ${LIB_DIR} ${DATA_DIR}; do chown -R ds:ds "$i" chmod -R 755 "$i" done` If I set the key to be 400 owned by root, and located it outside the data dir, and point to it with -e SSL_KEY_PATH will nginx be able to read it ? Looking at the ps output, the master nginx process is root. The part I am not sure about, what is a good location as I want to keep it outside the container and it cannot be in log, lib or data as the chmod operates on all of them - if this has been documented please post a link to the guide. All the setup guides I have seen just mention to change the key file to 400 - many people may not run ls -l after the docker restart to see that the key file is now 755 and owned by the ds user.
kerem 2026-02-26 10:31:02 +03:00
  • closed this issue
  • added the
    duplicate
    label
Author
Owner

@igwyd commented on GitHub (Mar 23, 2022):

Hello @bluesky-ca, we already have the same issue https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/240 and bug 50138 in our private issue tracker. Anyway, thanks for the detailed report.

<!-- gh-comment-id:1076188755 --> @igwyd commented on GitHub (Mar 23, 2022): Hello @bluesky-ca, we already have the same issue https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/240 and bug 50138 in our private issue tracker. Anyway, thanks for the detailed report.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/Docker-DocumentServer-ONLYOFFICE#215
No description provided.