diff --git a/ssl/start.sh b/ssl/start.sh
index ad4c36a..1a9055c 100755
--- a/ssl/start.sh
+++ b/ssl/start.sh
@@ -33,6 +33,7 @@ signkey="/kopano/ssl/konnectd-tokens-signing-key.pem"
 if [ ! -f $signkey ]; then
 	echo "creating new token signing key"
 	openssl genpkey -algorithm RSA -out $signkey.tmp -pkeyopt rsa_keygen_bits:4096
+	chmod go+r $signkey.tmp
 	mv $signkey.tmp $signkey
 fi