---
title: The registry certificate files should be individually and group owned by root
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > The registry certificate files should
  be individually and group owned by root
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# The registry certificate files should be individually and group owned by root
Classification:complianceFramework:cis-dockerControl:3.7 
## Description{% #description %}

The registry certificates should be owned by user root and group root.

## Rationale{% #rationale %}

The certificates under `/etc/docker/certs.d` decide which registries Docker trusts and how it authenticates to them. Its owner can change it, so the owner and group should be root only.

## Audit{% #audit %}

Show the owner and group of the registry directories and of the files in them:

```bash
stat -c '%n %U:%G' /etc/docker/certs.d/* /etc/docker/certs.d/*/*
```

Datadog checks the registry directories of `/etc/docker/certs.d` and the entries in them. It passes the rule when every one belongs to root:root, fails it when one belongs to another user or group, and reports it not applicable when there is none.

## Remediation{% #remediation %}

Set the owner and group of the registry directories and their files:

```bash
chown root:root /etc/docker/certs.d/* /etc/docker/certs.d/*/*
```

## Impact{% #impact %}

None.

## Default value{% #default-value %}

The administrator creates the registry certificates, with the owner and mode of the copy.

## References{% #references %}

1. [https://docs.docker.com/registry/insecure/](https://docs.docker.com/registry/insecure/)