---
title: The Docker server certificate key file needs to have permissions of 400
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > The Docker server certificate key file
  needs to have permissions of 400
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# The Docker server certificate key file needs to have permissions of 400
Classification:complianceFramework:cis-dockerControl:3.14 
## Description{% #description %}

The server key should have mode 400 or stricter.

## Rationale{% #rationale %}

The server key, given to dockerd with `--tlskey`, proves the identity of the daemon. Mode 400 lets only root read it.

## Audit{% #audit %}

Find the file that dockerd takes with `--tlskey`, or with `tlskey` in `daemon.json`, then show its mode:

```bash
ps -o args= -C dockerd
grep tlskey /etc/docker/daemon.json
stat -c '%a' <file>
```

Datadog reads the path that dockerd takes with the `--tlskey` flag, or with `tlskey` in its configuration file, and judges the file there: the flag's file wherever it is, or the file that the configuration names in `/etc/docker` or a directory in it. It passes the rule when the file has mode 400 or stricter, fails it when the mode is less strict, and reports it not applicable when dockerd names no such file. A file that the configuration names elsewhere, and the default files that dockerd reads from `~/.docker` when it runs with `--tlsverify` and no path, also report not applicable and stay for manual review.

## Remediation{% #remediation %}

Set the mode of the file:

```bash
chmod 400 <file>
```

## Impact{% #impact %}

None.

## Default value{% #default-value %}

The administrator creates the TLS files, with the owner and mode of the copy.

## References{% #references %}

1. [https://docs.docker.com/registry/insecure/](https://docs.docker.com/registry/insecure/)
1. [https://docs.docker.com/engine/security/protect-access/](https://docs.docker.com/engine/security/protect-access/)