diff --git a/spec/classes/elasticsearch_spec.rb b/spec/classes/elasticsearch_spec.rb
index 26d04c20..95196fbf 100644
--- a/spec/classes/elasticsearch_spec.rb
+++ b/spec/classes/elasticsearch_spec.rb
@@ -23,13 +23,13 @@
       when 'FreeBSD'
         let(:icinga2_conf_dir) { '/usr/local/etc/icinga2' }
         let(:icinga2_pki_dir) { '/var/lib/icinga2/certs' }
-        let(:icinga2_sslkey_mode) { '0400' }
+        let(:icinga2_sslkey_mode) { '0440' }
         let(:icinga2_user) { 'icinga' }
         let(:icinga2_group) { 'icinga' }
       else
         let(:icinga2_conf_dir) { '/etc/icinga2' }
         let(:icinga2_pki_dir) { '/var/lib/icinga2/certs' }
-        let(:icinga2_sslkey_mode) { '0400' }
+        let(:icinga2_sslkey_mode) { '0440' }
         case facts[:os]['family']
         when 'Debian'
           let(:icinga2_user) { 'nagios' }
diff --git a/spec/classes/gelf_spec.rb b/spec/classes/gelf_spec.rb
index f137894d..e6b54165 100644
--- a/spec/classes/gelf_spec.rb
+++ b/spec/classes/gelf_spec.rb
@@ -23,13 +23,13 @@
       when 'FreeBSD'
         let(:icinga2_conf_dir) { '/usr/local/etc/icinga2' }
         let(:icinga2_pki_dir) { '/var/lib/icinga2/certs' }
-        let(:icinga2_sslkey_mode) { '0400' }
+        let(:icinga2_sslkey_mode) { '0440' }
         let(:icinga2_user) { 'icinga' }
         let(:icinga2_group) { 'icinga' }
       else
         let(:icinga2_conf_dir) { '/etc/icinga2' }
         let(:icinga2_pki_dir) { '/var/lib/icinga2/certs' }
-        let(:icinga2_sslkey_mode) { '0400' }
+        let(:icinga2_sslkey_mode) { '0440' }
         case facts[:os]['family']
         when 'Debian'
           let(:icinga2_user) { 'nagios' }
diff --git a/spec/classes/icingadb_spec.rb b/spec/classes/icingadb_spec.rb
index e4c9ffd6..34c60e47 100644
--- a/spec/classes/icingadb_spec.rb
+++ b/spec/classes/icingadb_spec.rb
@@ -24,14 +24,14 @@
       when 'FreeBSD'
         let(:icinga2_conf_dir) { '/usr/local/etc/icinga2' }
         let(:icinga2_pki_dir) { '/var/lib/icinga2/certs' }
-        let(:icinga2_sslkey_mode) { '0400' }
+        let(:icinga2_sslkey_mode) { '0440' }
         let(:icinga2_sslfile_owner) { 'icinga' }
         let(:icinga2_sslfile_mode) { '0640' }
         let(:icinga2_group) { 'icinga' }
       else
         let(:icinga2_conf_dir) { '/etc/icinga2' }
         let(:icinga2_pki_dir) { '/var/lib/icinga2/certs' }
-        let(:icinga2_sslkey_mode) { '0400' }
+        let(:icinga2_sslkey_mode) { '0440' }
         let(:icinga2_sslfile_mode) { '0640' }
         case facts[:os]['family']
         when 'Debian'
diff --git a/spec/classes/idomysql_spec.rb b/spec/classes/idomysql_spec.rb
index 616f136e..9f372a14 100644
--- a/spec/classes/idomysql_spec.rb
+++ b/spec/classes/idomysql_spec.rb
@@ -42,14 +42,14 @@
         let(:icinga2_conf_dir) { '/usr/local/etc/icinga2' }
         let(:icinga2_pki_dir) { '/var/lib/icinga2/certs' }
         let(:ido_mysql_schema_dir) { '/usr/local/share/icinga2-ido-mysql/schema' }
-        let(:icinga2_sslkey_mode) { '0400' }
+        let(:icinga2_sslkey_mode) { '0440' }
         let(:icinga2_user) { 'icinga' }
         let(:icinga2_group) { 'icinga' }
       else
         let(:icinga2_conf_dir) { '/etc/icinga2' }
         let(:icinga2_pki_dir) { '/var/lib/icinga2/certs' }
         let(:ido_mysql_schema_dir) { '/usr/share/icinga2-ido-mysql/schema' }
-        let(:icinga2_sslkey_mode) { '0400' }
+        let(:icinga2_sslkey_mode) { '0440' }
         case facts[:os]['family']
         when 'Debian'
           let(:icinga2_user) { 'nagios' }
diff --git a/spec/classes/idopgsql_spec.rb b/spec/classes/idopgsql_spec.rb
index 57995b0d..40e19652 100644
--- a/spec/classes/idopgsql_spec.rb
+++ b/spec/classes/idopgsql_spec.rb
@@ -25,14 +25,14 @@
         let(:icinga2_conf_dir) { '/usr/local/etc/icinga2' }
         let(:icinga2_pki_dir) { '/var/lib/icinga2/certs' }
         let(:ido_pgsql_schema_dir) { '/usr/local/share/icinga2-ido-pgsql/schema' }
-        let(:icinga2_sslkey_mode) { '0400' }
+        let(:icinga2_sslkey_mode) { '0440' }
         let(:icinga2_user) { 'icinga' }
         let(:icinga2_group) { 'icinga' }
       else
         let(:icinga2_conf_dir) { '/etc/icinga2' }
         let(:icinga2_pki_dir) { '/var/lib/icinga2/certs' }
         let(:ido_pgsql_schema_dir) { '/usr/share/icinga2-ido-pgsql/schema' }
-        let(:icinga2_sslkey_mode) { '0400' }
+        let(:icinga2_sslkey_mode) { '0440' }
         case facts[:os]['family']
         when 'Debian'
           let(:icinga2_user) { 'nagios' }
diff --git a/spec/classes/influxdb2_spec.rb b/spec/classes/influxdb2_spec.rb
index af80d691..679dde9a 100644
--- a/spec/classes/influxdb2_spec.rb
+++ b/spec/classes/influxdb2_spec.rb
@@ -23,13 +23,13 @@
       when 'FreeBSD'
         let(:icinga2_conf_dir) { '/usr/local/etc/icinga2' }
         let(:icinga2_pki_dir) { '/var/lib/icinga2/certs' }
-        let(:icinga2_sslkey_mode) { '0400' }
+        let(:icinga2_sslkey_mode) { '0440' }
         let(:icinga2_user) { 'icinga' }
         let(:icinga2_group) { 'icinga' }
       else
         let(:icinga2_conf_dir) { '/etc/icinga2' }
         let(:icinga2_pki_dir) { '/var/lib/icinga2/certs' }
-        let(:icinga2_sslkey_mode) { '0400' }
+        let(:icinga2_sslkey_mode) { '0440' }
         case facts[:os]['family']
         when 'Debian'
           let(:icinga2_user) { 'nagios' }
diff --git a/spec/classes/influxdb_spec.rb b/spec/classes/influxdb_spec.rb
index dbbb8e33..1b5926af 100644
--- a/spec/classes/influxdb_spec.rb
+++ b/spec/classes/influxdb_spec.rb
@@ -23,13 +23,13 @@
       when 'FreeBSD'
         let(:icinga2_conf_dir) { '/usr/local/etc/icinga2' }
         let(:icinga2_pki_dir) { '/var/lib/icinga2/certs' }
-        let(:icinga2_sslkey_mode) { '0400' }
+        let(:icinga2_sslkey_mode) { '0440' }
         let(:icinga2_user) { 'icinga' }
         let(:icinga2_group) { 'icinga' }
       else
         let(:icinga2_conf_dir) { '/etc/icinga2' }
         let(:icinga2_pki_dir) { '/var/lib/icinga2/certs' }
-        let(:icinga2_sslkey_mode) { '0400' }
+        let(:icinga2_sslkey_mode) { '0440' }
         case facts[:os]['family']
         when 'Debian'
           let(:icinga2_user) { 'nagios' }