diff --git a/Changelog.md b/Changelog.md
index 019014e4..1a5744bc 100644
--- a/Changelog.md
+++ b/Changelog.md
@@ -14,6 +14,9 @@ New
 
 Improvements
 
+* TLS keys are now stored with the mode set to 0600 on Unix systems.
+  ([#1376])
+
 Bug fixes
 
 Other changes
@@ -22,6 +25,7 @@ Other changes
   This primarily adds a new ASPA UI. ([#1373])
 
 [#1373]: https://github.com/NLnetLabs/krill/pull/1373
+[#1376]: https://github.com/NLnetLabs/krill/pull/1376
 [#1378]: https://github.com/NLnetLabs/krill/pull/1378
 [#1383]: https://github.com/NLnetLabs/krill/pull/1383
 [krill-ui 0.10.0]: https://github.com/NLnetLabs/krill-ui/releases/tag/v0.10.0
diff --git a/src/commons/file.rs b/src/commons/file.rs
index 8ffa66a5..5706889b 100644
--- a/src/commons/file.rs
+++ b/src/commons/file.rs
@@ -4,8 +4,10 @@
 
 use std::{fmt, fs, io};
 use std::borrow::Cow;
-use std::fs::File;
+use std::fs::{File, OpenOptions};
 use std::io::{Read, Write};
+#[cfg(unix)]
+use std::os::unix::fs::OpenOptionsExt;
 use std::path::{Path, PathBuf};
 use std::str::FromStr;
 use bytes::Bytes;
@@ -55,6 +57,19 @@ pub fn remove_dir_all(dir: &Path) -> Result<(), KrillIoError> {
 /// Creates a new File or opens an exiting one. If the file did not exist, the
 /// path will be created if it did not exist yet.
 pub fn create_file_with_path(path: &Path) -> Result<File, KrillIoError> {
+    create_file(path, false)
+}
+
+/// Creates a new File or opens an exiting one. If the file did not exist, the
+/// path will be created if it did not exist yet.
+pub fn create_private_file_with_path(path: &Path) -> Result<File, KrillIoError> {
+    create_file(path, true)
+}
+
+/// Creates a file.
+///
+/// If `private` is `true`, will set the file mode to `0o600` on Unix.
+fn create_file(path: &Path, private: bool) -> Result<File, KrillIoError> {
     if 
         !path.exists()
         && let Some(parent) = path.parent()
@@ -70,7 +85,15 @@ pub fn create_file_with_path(path: &Path) -> Result<File, KrillIoError> {
             )
         })?;
     }
-    File::create(path).map_err(|e| {
+    let mut options = OpenOptions::new();
+    options.create(true);
+    options.read(true);
+    options.write(true);
+    #[cfg(unix)]
+    if private {
+        options.mode(0o600);
+    }
+    options.open(path).map_err(|e| {
         KrillIoError::new(
             format!("Could not create file: {}", path.to_string_lossy()),
             e,
@@ -99,6 +122,21 @@ pub fn save(content: &[u8], full_path: &Path) -> Result<(), KrillIoError> {
     Ok(())
 }
 
+/// Saves a file, creating parent dirs as needed
+pub fn save_private(content: &[u8], full_path: &Path) -> Result<(), KrillIoError> {
+    let mut f = create_private_file_with_path(full_path)?;
+
+    f.write_all(content).map_err(|e| {
+        KrillIoError::new(
+            format!("Could not write to: {}", full_path.to_string_lossy()),
+            e,
+        )
+    })?;
+    
+    trace!("Saved file: {}", full_path.to_string_lossy());
+    Ok(())
+}
+
 /// Saves an object to json - unwraps any json errors!
 pub fn save_json<O: Serialize>(
     object: &O,
diff --git a/src/daemon/http/tls_keys.rs b/src/daemon/http/tls_keys.rs
index 1e59525b..d7d43bfd 100644
--- a/src/daemon/http/tls_keys.rs
+++ b/src/daemon/http/tls_keys.rs
@@ -128,7 +128,7 @@ impl HttpsSigner {
     fn save_private_key(&self, tls_keys_dir: &Path) -> Result<(), Error> {
         let key_file_path = key_file_path(tls_keys_dir);
         let bytes = Bytes::from(self.private.private_key_to_pem_pkcs8()?);
-        file::save(&bytes, &key_file_path)?;
+        file::save_private(&bytes, &key_file_path)?;
         Ok(())
     }