diff --git a/acme.sh b/acme.sh
index f255c43f..48c5ec79 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4178,6 +4178,7 @@ _installcert() {
       cp "$_real_key" "$_backup_path/key.bak"
     fi
     cat "$CERT_KEY_PATH" >"$_real_key"
+    chmod go-rwx "$_real_key"
   fi
 
   if [ "$_real_fullchain" ]; then