diff --git a/README.md b/README.md
index 37c9ff01..51a1323d 100644
--- a/README.md
+++ b/README.md
@@ -391,6 +391,8 @@ This improves security and scalability of the front-facing NGINX server but lead
 
 **TLS/SSL:** The existing `./ssl` volume mount from `misp-core` is moved to the `misp-nginx` container, so existing certificates keep working.
 
+**Permissions:** `misp-nginx` runs as a non-root user (uid/gid `101`) and mounts `./ssl` read-only, so `cert.pem` and `key.pem` must be readable by that user. If `key.pem` is owned by `root` with mode `600`, HTTPS will not work. Grant read access with `chgrp 101 ssl/key.pem && chmod 640 ssl/key.pem` or, since gid `101` may already belong to an unrelated group on the host (e.g. `ssh_keys` on RHEL), with an ACL: `setfacl -m u:101:r ssl/key.pem`.
+
 **Certificates:** SSL is disabled if certificates are missing, but you can generate self-signed certificates with the following command: `mkdir -p ./ssl/ && openssl req -x509 -subj '/CN=localhost' -nodes -newkey rsa:4096 -keyout ssl/key.pem -out ssl/cert.pem -days 365 -addext "subjectAltName = DNS:localhost, IP:127.0.0.1, IP:::1"`
 
 **GPG key delivery:** `gpg.asc` is now served via `misp-nginx`, which proxies the request through to `misp-core` (PHP-FPM) rather than serving a static file from the webroot path.
diff --git a/nginx/files/04-ssl.sh b/nginx/files/04-ssl.sh
index 288e1ddf..edd84bfe 100755
--- a/nginx/files/04-ssl.sh
+++ b/nginx/files/04-ssl.sh
@@ -13,6 +13,15 @@ if [ ! -f "/etc/nginx/certs/cert.pem" ] || [ ! -f "/etc/nginx/certs/key.pem" ];
     exit 0
 fi
 
+# ensure certificates are readable by the user running nginx
+for f in /etc/nginx/certs/cert.pem /etc/nginx/certs/key.pem; do
+    if [ ! -r "$f" ]; then
+        echo "ERROR: $f exists but is not readable by uid $(id -u) / gid $(id -g)." >&2
+        echo "ERROR: Fix the permissions on the host, e.g. 'chgrp $(id -g) ssl/$(basename "$f") && chmod 640 ssl/$(basename "$f")'." >&2
+        exit 1
+    fi
+done
+
 # build redirect config if the BASE_URL is set
 if [ -n "$BASE_URL" ]; then
     cat >> "$REDIRECT_CONF" <<EOF