What should be the permissions and owner of the certificate and key files of the OpenVPN server?

Question

linux

I welcome everyone!
I put OpenVPN on a VPS under Debian. Generated keys, certificates, Diffie-Hellman keys. Created a user to run the OpenVPN daemon.
Tell me, what should be the access rights and who should be the owner of the key files and certificates on the server side?

Answer 1

Owner - user to run the daemon.
Permissions 400 (read access to owner only) for private key files. Certificates are public information and the access level can be quite 444. The superuser will still be able to have full access to files, regardless of the owner and the rights set.

Answer 2

Better than 600 owner root

Answer 3

For keys and prime - root:root 0600, for certificates root:root 0644