diff --git a/lib/puppet/provider/katello_ssl_tool.rb b/lib/puppet/provider/katello_ssl_tool.rb
index 4ee1b9cc..cb77212e 100644
--- a/lib/puppet/provider/katello_ssl_tool.rb
+++ b/lib/puppet/provider/katello_ssl_tool.rb
@@ -175,7 +175,7 @@ def exists?
     end
 
     def create
-      File.open(resource[:path], "w") { |f| f << expected_content }
+      File.open(resource[:path], "w", mode) { |f| f << expected_content }
     end
 
     protected
@@ -198,6 +198,10 @@ def source_path
       raise NotImplementedError
     end
 
+    def mode
+      0644
+    end
+
     def cert_details
       return @cert_details if defined? @cert_details
       if cert_resource = @resource[:cert]
diff --git a/lib/puppet/provider/privkey/katello_ssl_tool.rb b/lib/puppet/provider/privkey/katello_ssl_tool.rb
index e9442569..a73e4bf9 100644
--- a/lib/puppet/provider/privkey/katello_ssl_tool.rb
+++ b/lib/puppet/provider/privkey/katello_ssl_tool.rb
@@ -8,4 +8,8 @@ def source_path
     cert_details[:privkey]
   end
 
+  def mode
+    0400
+  end
+
 end