diff --git a/puppet/extraconfig/tls/ca-inject.yaml b/puppet/extraconfig/tls/ca-inject.yaml
index 5a36e9516c..aab4284964 100644
--- a/puppet/extraconfig/tls/ca-inject.yaml
+++ b/puppet/extraconfig/tls/ca-inject.yaml
@@ -45,7 +45,7 @@ resources:
         cat > ${cacert_path} << EOF
         ${cacert_content}
         EOF
-        chmod 0440 ${cacert_path}
+        chmod 0444 ${cacert_path}
         chown root:root ${cacert_path}
         ${update_anchor_command}
         md5sum ${cacert_path} > ${heat_outputs_path}.root_cert_md5sum