Private key written to filesystem with w+

The private key file is created with default umask permissions (typically 644 on Linux — readable by all users). On a multi-user system or if the certs directory is accessible, any process can read the device private key.

Fix: Set restrictive file permissions:

import os
fd = os.open('{}/{}'.format(self.secure_cert_path, self.new_key_name),
os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
with os.fdopen(fd, 'w') as f:
f.write(payload['privateKey'])

Search the codebase for the private-key write using w+ and the self.new_key_name or secure_cert_path references. Start by reading that file-writing path and verify the private-key file is created with mode 0600 rather than default umask permissions. Done means the key is no longer readable by other users.

Written by the indexing model from the issue text.