diff --git a/nginx/startup.sh b/nginx/startup.sh
index f8e7b229..0f088ad0 100644
--- a/nginx/startup.sh
+++ b/nginx/startup.sh
@@ -4,6 +4,7 @@ if [ ! -f /etc/nginx/ssl/default.crt ]; then
     openssl genrsa -out "/etc/nginx/ssl/default.key" 2048
     openssl req -new -key "/etc/nginx/ssl/default.key" -out "/etc/nginx/ssl/default.csr" -subj "/CN=default/O=default/C=UK"
     openssl x509 -req -days 365 -in "/etc/nginx/ssl/default.csr" -signkey "/etc/nginx/ssl/default.key" -out "/etc/nginx/ssl/default.crt"
+    chmod 644 /etc/nginx/ssl/default.key
 fi
 
 # Start crond in background