diff --git a/certs/Makefile b/certs/Makefile
index 6ffb6bd7c..534aa0d48 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -59,5 +59,5 @@ keysize=2048
 	sed 's,example\.com,$*,g' openssl.cnf > $@
 
 %.key:
-	openssl genrsa $(keysize) > $@
-	@chmod 400 $@
+	umask 0077 && openssl genrsa -out $@ $(keysize)
+	@chmod 400 $@ -c