diff --git a/manifests/cert.pp b/manifests/cert.pp
index cce2f95..01e7cec 100644
--- a/manifests/cert.pp
+++ b/manifests/cert.pp
@@ -24,7 +24,7 @@
       group => $group,
       mode  => '0640',
     }
-    $key_mode = '0400'
+    $key_mode = '0440'
   }
 
   if $args[key] {
diff --git a/spec/defines/cert_spec.rb b/spec/defines/cert_spec.rb
index 4bfa031..7b26eda 100644
--- a/spec/defines/cert_spec.rb
+++ b/spec/defines/cert_spec.rb
@@ -43,7 +43,7 @@
             {
               'owner' => 'foo',
               'group' => 'bar',
-              'mode'  => '0400',
+              'mode'  => '0440',
             }
           ).with_content('key')
         }