chmod 400 on /etc/certs