use umask 077 to protect private keys

diff --git a/letsencrypt.sh b/letsencrypt.sh
index 8e6e2315398ef031c6d73f943af16985da2ad4e6..51249f2ad652c46e968a2aaa1eb9bfc5185877fa 100755 (executable)
--- a/letsencrypt.sh
+++ b/letsencrypt.sh
@@ -4,6 +4,9 @@ set -eu
 
 . ./config.sh
 
+umask 077 # paranoid umask, we're creating private keys
+
+
 urlbase64() {
   base64 -w 0 | sed -r 's/=*$//g' | tr '+/' '-_'
 }