---
title: The TLS CA certificate file should be owned by root account
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > The TLS CA certificate file should be
  owned by root account
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# The TLS CA certificate file should be owned by root account
Classification:complianceFramework:cis-dockerControl:3.9 
## Description{% #description %}

The TLS CA certificate should be owned by user root and group root.

## Rationale{% #rationale %}

The TLS CA certificate, given to dockerd with `--tlscacert`, decides which clients the daemon accepts. Its owner can change it, so the owner and group should be root only.

## Audit{% #audit %}

Find the file that dockerd takes with `--tlscacert`, or with `tlscacert` in `daemon.json`, then show its owner and group:

```bash
ps -o args= -C dockerd
grep tlscacert /etc/docker/daemon.json
stat -c '%U:%G' <file>
```

Datadog reads the path that dockerd takes with the `--tlscacert` flag, or with `tlscacert` in its configuration file, and judges the file there: the flag's file wherever it is, or the file that the configuration names in `/etc/docker` or a directory in it. It passes the rule when the file belongs to root:root, fails it when it belongs to another user or group, and reports it not applicable when dockerd names no such file. A file that the configuration names elsewhere, and the default files that dockerd reads from `~/.docker` when it runs with `--tlsverify` and no path, also report not applicable and stay for manual review.

## Remediation{% #remediation %}

Set the owner and group of the file:

```bash
chown root:root <file>
```

## Impact{% #impact %}

None.

## Default value{% #default-value %}

The administrator creates the TLS files, with the owner and mode of the copy.

## References{% #references %}

1. [https://docs.docker.com/registry/insecure/](https://docs.docker.com/registry/insecure/)
1. [https://docs.docker.com/engine/security/protect-access/](https://docs.docker.com/engine/security/protect-access/)