diff --git a/product/ERP5/Tool/CertificateAuthorityTool.py b/product/ERP5/Tool/CertificateAuthorityTool.py
index ad5f8b16228985c38a50b8a7b1ff0460946697bd..6a9bc265e3823255ada7d29b0e38fbb3c2b7a28d 100644
--- a/product/ERP5/Tool/CertificateAuthorityTool.py
+++ b/product/ERP5/Tool/CertificateAuthorityTool.py
@@ -202,6 +202,7 @@ class CertificateAuthorityTool(BaseTool):
       cert = os.path.join(self.certificate_authority_path, 'certs',
           new_id + '.crt')
       try:
+        os.close(os.open(key, os.O_CREAT | os.O_EXCL, 0600))
         popenCommunicate([self.openssl_binary, 'req', '-nodes', '-config',
           self.openssl_config, '-new', '-keyout', key, '-out', csr, '-days',
           '3650'], '%s\n' % common_name, stdin=subprocess.PIPE)