diff --git a/contrib/scripts/ast_tls_cert b/contrib/scripts/ast_tls_cert
index 9ed3b7188b4b054d363804e9178b92038920e2ba..4f540fdd2b66bfec7f44699bdb3aecffd3d46151 100755
--- a/contrib/scripts/ast_tls_cert
+++ b/contrib/scripts/ast_tls_cert
@@ -105,8 +105,6 @@ OUTPUT_BASE=asterisk # Our default cert basename
 CERT_MODE=server
 ORG_NAME=${DEFAULT_ORG}
 
-umask 377
-
 while getopts "hf:c:k:o:d:m:C:O:" OPTION
 do
 	case ${OPTION} in
@@ -152,6 +150,8 @@ else
 	mkdir -p "${OUTPUT_DIR}"
 fi
 
+umask 177
+
 case "${CERT_MODE}" in
 	server)
 		COMMON_NAME=${COMMON_NAME:-"${DEFAULT_SERVER_CN}"}