diff --git a/cups/file.c b/cups/file.c
index 8ec4bbb04..1fc1b9b2f 100644
--- a/cups/file.c
+++ b/cups/file.c
@@ -642,7 +642,7 @@ cupsFileOpen(const char *filename,	// I - Name of file
   if ((ptr = strchr(mode, 'm')) != NULL && ptr[1] >= '0' && ptr[1] <= '7')
   {
     // Get permissions from mode string...
-    perm = (int)strtol(mode + 1, NULL, 8);
+    perm = (int)strtol(ptr + 1, NULL, 8);
   }
 
   // Open the file...
diff --git a/cups/testcreds.c b/cups/testcreds.c
index 176d3aeeb..8f7a5d161 100644
--- a/cups/testcreds.c
+++ b/cups/testcreds.c
@@ -409,6 +409,7 @@ do_unit_tests(void)
 			*chain;		// Cert chain data
   size_t		chainlen;	// Length of cert chain data
   http_trust_t		trust;		// Trust in credentials
+  struct stat		fileinfo;	// Key file information
   static const char * const alt_names[] =
   {					// subjectAltName values
     "printer.example.com",
@@ -442,6 +443,14 @@ do_unit_tests(void)
       data = cupsCopyCredentialsKey(TEST_CERT_PATH, "_site_");
       testEnd(data != NULL);
       free(data);
+
+      testBegin("_site_.key permissions");
+      if (stat(TEST_CERT_PATH "/_site_.key", &fileinfo))
+        testEndMessage(false, "%s", strerror(errno));
+      else if (fileinfo.st_mode & 077)
+        testEndMessage(false, "wrong permissions, got %03o expected %03o.", (unsigned)(fileinfo.st_mode & 0777), (unsigned)(fileinfo.st_mode & 0700));
+      else
+        testEnd(true);
     }
     else
     {
@@ -520,6 +529,14 @@ do_unit_tests(void)
       testEnd(data != NULL);
       free(data);
 
+      testBegin("altprinter.ktm permissions");
+      if (stat(TEST_CERT_PATH "/altprinter.ktm", &fileinfo))
+        testEndMessage(false, "%s", strerror(errno));
+      else if (fileinfo.st_mode & 077)
+        testEndMessage(false, "wrong permissions, got %03o expected %03o.", (unsigned)(fileinfo.st_mode & 0777), (unsigned)(fileinfo.st_mode & 0700));
+      else
+        testEnd(true);
+
       testBegin("cupsCopyCredentialsRequest(altprinter w/alt names)");
       data = cupsCopyCredentialsRequest(TEST_CERT_PATH, "altprinter");
       testEnd(data != NULL);
diff --git a/cups/tls-gnutls.c b/cups/tls-gnutls.c
index 3939068f2..7c4e74f58 100644
--- a/cups/tls-gnutls.c
+++ b/cups/tls-gnutls.c
@@ -231,7 +231,7 @@ cupsCreateCredentials(
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, gnutls_strerror(err), 0);
     goto done;
   }
-  else if ((fp = cupsFileOpen(keyfile, "w")) != NULL)
+  else if ((fp = cupsFileOpen(keyfile, "wm600")) != NULL)
   {
     DEBUG_printf("1cupsCreateCredentials: Writing private key to \"%s\".", keyfile);
     cupsFileWrite(fp, (char *)buffer, bytes);
@@ -586,7 +586,7 @@ cupsCreateCredentialsRequest(
     DEBUG_printf("1cupsCreateCredentialsRequest: Unable to export private key: %s", gnutls_strerror(err));
     goto done;
   }
-  else if ((fp = cupsFileOpen(keyfile, "w")) != NULL)
+  else if ((fp = cupsFileOpen(keyfile, "wm600")) != NULL)
   {
     DEBUG_printf("1cupsCreateCredentialsRequest: Writing private key to \"%s\".", keyfile);
     cupsFileWrite(fp, (char *)buffer, bytes);
diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index fa415e484..ee079de6a 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -35,6 +35,7 @@ static X509_EXTENSION	*openssl_create_san(const char *common_name, size_t num_al
 static time_t		openssl_get_date(X509 *cert, int which);
 //static void		openssl_load_crl(void);
 static STACK_OF(X509 *)	openssl_load_x509(const char *credentials);
+static BIO		*openssl_open_file(const char *filename, int mode);
 static bool		openssl_validate_name(X509 *cert, const char *common_name);
 
 
@@ -370,7 +371,7 @@ cupsCreateCredentials(
   http_make_path(keyfile, sizeof(keyfile), path, common_name, "key");
   http_make_path(pubfile, sizeof(pubfile), path, common_name, "pub");
 
-  if ((bio = BIO_new_file(keyfile, "wb")) == NULL)
+  if ((bio = openssl_open_file(keyfile, 0600)) == NULL)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
     goto done;
@@ -385,7 +386,7 @@ cupsCreateCredentials(
 
   BIO_free(bio);
 
-  if ((bio = BIO_new_file(pubfile, "wb")) == NULL)
+  if ((bio = openssl_open_file(pubfile, 0644)) == NULL)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
     goto done;
@@ -400,7 +401,7 @@ cupsCreateCredentials(
 
   BIO_free(bio);
 
-  if ((bio = BIO_new_file(crtfile, "wb")) == NULL)
+  if ((bio = openssl_open_file(crtfile, 0644)) == NULL)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
     goto done;
@@ -606,7 +607,7 @@ cupsCreateCredentialsRequest(
   sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
 
   // Save them...
-  if ((bio = BIO_new_file(keyfile, "wb")) == NULL)
+  if ((bio = openssl_open_file(keyfile, 0600)) == NULL)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
     goto done;
@@ -621,7 +622,7 @@ cupsCreateCredentialsRequest(
 
   BIO_free(bio);
 
-  if ((bio = BIO_new_file(pubfile, "wb")) == NULL)
+  if ((bio = openssl_open_file(pubfile, 0644)) == NULL)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
     goto done;
@@ -636,7 +637,7 @@ cupsCreateCredentialsRequest(
 
   BIO_free(bio);
 
-  if ((bio = BIO_new_file(csrfile, "wb")) == NULL)
+  if ((bio = openssl_open_file(csrfile, 0644)) == NULL)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
     goto done;
@@ -1411,7 +1412,7 @@ cupsSignCredentialsRequest(
   // Save the certificate...
   http_make_path(crtfile, sizeof(crtfile), path, common_name, "crt");
 
-  if ((bio = BIO_new_file(crtfile, "wb")) == NULL)
+  if ((bio = openssl_open_file(crtfile, 0644)) == NULL)
   {
     _cupsSetError(IPP_STATUS_ERROR_INTERNAL, strerror(errno), 0);
     goto done;
@@ -2609,6 +2610,28 @@ openssl_load_x509(
 }
 
 
+//
+// 'openssl_open_file()' - Create a file for writing with the given permissions.
+//
+
+static BIO *				// O - File BIO or `NULL` on error
+openssl_open_file(const char *filename,	// I - Filename
+                  int        mode)	// I - Permissions
+{
+  int	fd;				// File descriptor
+  BIO	*bio;				// File BIO
+
+
+  if ((fd = open(filename, O_CREAT | O_WRONLY | O_TRUNC, mode)) < 0)
+    return (NULL);
+
+  if ((bio = BIO_new_fd(fd, BIO_CLOSE)) == NULL)
+    close(fd);
+
+  return (bio);
+}
+
+
 //
 // 'openssl_validate_name()' - Check that the certificate is valid for the given name.
 //
diff --git a/cups/tls.c b/cups/tls.c
index eeacb653b..75ee9f9f4 100644
--- a/cups/tls.c
+++ b/cups/tls.c
@@ -811,7 +811,7 @@ http_save_file(const char *path,	// I - Directory path for certificate/key store
     return (true);
   }
 
-  if ((fd = open(filename, O_CREAT | O_WRONLY | O_TRUNC, 0644)) < 0)
+  if ((fd = open(filename, O_CREAT | O_WRONLY | O_TRUNC, (strcmp(ext, "key") && strcmp(ext, "ktm")) ? 0644 : 0600)) < 0)
     return (false);
 
   if (write(fd, value, strlen(value)) < 0)