diff --git a/contrib/util/certs.sh b/contrib/util/certs.sh
index bc6cdca3f5..67c572ac90 100755
--- a/contrib/util/certs.sh
+++ b/contrib/util/certs.sh
@@ -21,6 +21,7 @@
 #   intermediate-ca.key.
 
 set -e
+umask 027
 
 CONFIG="
 [v3_ca]