diff --git a/module/mysql/module.sh b/module/mysql/module.sh
index 11215bd..de28468 100644
--- a/module/mysql/module.sh
+++ b/module/mysql/module.sh
@@ -160,12 +160,15 @@
 	# Duplicate ca as it needs to be mounted client side
 	cp -ar $ca_f $ca_dup_f
 
-	set_mode "0644" $mysql_uid \
-			 $ca_f $ca_dup_f \
-			 $server_key_f $server_req_f $server_cert_f \
-			 $client_key_f $client_req_f $client_cert_f || return $s_err
+	set_mode "0644" $mysql_uid $ca_f \
+		 $server_key_f $server_req_f $server_cert_f || return $s_err
+
+	# WARNING! The only client expected is apache. This can break other clients
+	set_mode "0644" "www-data" \
+		 $ca_dup_f $client_key_f $client_cert_f || return $s_err
 
 	set_mode "0600" $mysql_uid $ca_key_f || return $s_err
+	set_mode "0755" root $certificates_d || return $s_err
 }
 
 function __mysql_do_dummy_cert