explicitly set the permissions on generated CA.