---
title: >-
  The TLS CA certificate file should have read-only or more restrictive
  permissions
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > The TLS CA certificate file should have
  read-only or more restrictive permissions
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# The TLS CA certificate file should have read-only or more restrictive permissions
Classification:complianceFramework:cis-dockerControl:3.10 
## Description{% #description %}

The TLS CA certificate should have mode 444 or stricter.

## Rationale{% #rationale %}

The TLS CA certificate, given to dockerd with `--tlscacert`, decides which clients the daemon accepts. Mode 444 or stricter keeps everyone from writing it.

## Audit{% #audit %}

Find the file that dockerd takes with `--tlscacert`, or with `tlscacert` in `daemon.json`, then show its mode:

```bash
ps -o args= -C dockerd
grep tlscacert /etc/docker/daemon.json
stat -c '%a' <file>
```

Datadog reads the path that dockerd takes with the `--tlscacert` flag, or with `tlscacert` in its configuration file, and judges the file there: the flag's file wherever it is, or the file that the configuration names in `/etc/docker` or a directory in it. It passes the rule when the file has mode 444 or stricter, fails it when the mode is less strict, and reports it not applicable when dockerd names no such file. A file that the configuration names elsewhere, and the default files that dockerd reads from `~/.docker` when it runs with `--tlsverify` and no path, also report not applicable and stay for manual review.

## Remediation{% #remediation %}

Set the mode of the file:

```bash
chmod 444 <file>
```

## Impact{% #impact %}

None.

## Default value{% #default-value %}

The administrator creates the TLS files, with the owner and mode of the copy.

## References{% #references %}

1. [https://docs.docker.com/registry/insecure/](https://docs.docker.com/registry/insecure/)
1. [https://docs.docker.com/engine/security/protect-access/](https://docs.docker.com/engine/security/protect-access/)