Only authenticated system administrators or the designated PKI Sponsor for an Automation Controller NGINX web server must have access to any Automation Controller NGINX web server's private key.

Each Automation Controller NGINX web server's private key is used to prove the identity of the server to clients and securely exchange the shared secret key used to encrypt communications between the Automation Controller NGINX web server and clients.

By gaining access to the private key, an attacker can pretend to be an authorized server and decrypt the SSL traffic between a client and the Automation Controller NGINX web server.

As a system administrator (SA) for each Automation Controller NGINX web server host, verify the location and permissions of the private key:

For containerized deployments, enter the controller web container namespace or use podman exec: TOWER_KEY=$(nginx -T 2>&1 | sed -n 's/^\s*ssl_certificate_key\s*\(.*\);/\1/p' | head -1) stat -c "%a %U %G" $TOWER_KEY

Verify the key file is readable only by the service account running the NGINX process (permission mode 400 or 600, owned by the service user). If the key is world-readable or group-readable by an unauthorized group, this is a finding.

As an SA for each Automation Controller NGINX web server host, set the permissions:

TOWER_KEY=$(nginx -T 2>&1 | sed -n 's/^\s*ssl_certificate_key\s*\(.*\);/\1/p' | head -1) chown <service_user>:<service_group> $TOWER_KEY chmod 600 $TOWER_KEY

Note: In containerized deployments (AAP 2.6+), the service user is typically 'rhel' or the mapped UID, not root:awx. Verify the key is owned by the user running the NGINX process.