diff --git a/roles/etcd/templates/make-ssl-etcd.sh.j2 b/roles/etcd/templates/make-ssl-etcd.sh.j2
index 11d555bd2..f2aa02c30 100644
--- a/roles/etcd/templates/make-ssl-etcd.sh.j2
+++ b/roles/etcd/templates/make-ssl-etcd.sh.j2
@@ -101,5 +101,5 @@ if [ -e "$SSLDIR/ca-key.pem" ]; then
 fi
 
 if [ -n "$(ls -A *.pem)" ]; then
-    mv *.pem ${SSLDIR}/
+    install -o {{ etcd_owner | quote }} -g {{ etcd_cert_group | quote }} -m 0640 -- *.pem "${SSLDIR}/"
 fi