 have group read access (that is, <code class="literal">0640</code>
   permissions).  That setup is intended for installations where certificate
   and key files are managed by the operating system.  The user under which
   the <span class="productname">PostgreSQL</span> server runs should then be made a
   member of the group that has access to those certificate and key files.
  </p><p>
    If the data directory allows group read access then certificate files may
    need to be located outside of the data 