# Best Practice for server.ssl.key Permissions in Kibana?

**URL:** <https://discuss.elastic.co/t/best-practice-for-server-ssl-key-permissions-in-kibana/376710>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [April 2, 2025, 5:49pm UTC](https://discuss.elastic.co/t/best-practice-for-server-ssl-key-permissions-in-kibana/376710 "2025-04-02T17:49:18Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![anpama](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@anpama](https://discuss.elastic.co/u/anpama)\
**Post date:** [April 2, 2025, 5:49pm UTC](https://discuss.elastic.co/t/best-practice-for-server-ssl-key-permissions-in-kibana/376710/1 "2025-04-02T17:49:18Z")

</div>

Hi everyone,

I'm setting up SSL for Kibana (via server.ssl.key in kibana.yml) to encrypt browser traffic. My private key file has 600 permissions, and Kibana can’t read it unless I run it as root.

However, both the docs and the program warn:  
“Kibana should not be run as root. Use --allow-root to continue.”

What are the best practices in this case?

- Should I loosen the key file's permissions?
- Should I use --allow-root?
- Anything else I should consider?

Thanks!

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [April 2, 2025, 9:42pm UTC](https://discuss.elastic.co/t/best-practice-for-server-ssl-key-permissions-in-kibana/376710/2 "2025-04-02T21:42:01Z")

</div>

Hi @anpama

> [@anpama](#):
>
> - Should I loosen the key file's permissions? Yes, that is a common approach, you could change the owner to the kibana user to keep the restriction tight (depending on how you installed)
> - Should I use --allow-root? No
> - Anything else I should consider? You could protect the key with a passphrase, you could put the passphrase in the kibana keystore...