diff --git a/sendmail.spec b/sendmail.spec
index 3d22e2c13c5baacec6942b34ac7efe4bbc45a13c..db10710b7295deb77492277509cf3c6757bbc873 100644
--- a/sendmail.spec
+++ b/sendmail.spec
@@ -1,6 +1,6 @@
 Name:          sendmail
 Version:       8.17.1
-Release:       5
+Release:       6
 Summary:       A classic mail transfer agent from the Unix world
 License:       Sendmail
 URL:           http://www.sendmail.org/
@@ -344,7 +344,7 @@ if [ ! -f %{_sysconfdir}/pki/tls/certs/sendmail.pem ]; then
     %{_bindir}/openssl req -new -key %{_sysconfdir}/pki/tls/private/sendmail.key -x509 -sha256 \
         -days 365 -set_serial $RANDOM -out %{_sysconfdir}/pki/tls/certs/sendmail.pem \
         -subj "/C=--/ST=SomeState/L=SomeCity/O=SomeOrganization/OU=SomeOrganizationalUnit/CN=${FQDN}/emailAddress=root@${FQDN}"
-    chmod 644 %{_sysconfdir}/pki/tls/certs/sendmail.pem
+    chmod 600 %{_sysconfdir}/pki/tls/certs/sendmail.pem
 fi
 
 exit 0
@@ -467,6 +467,12 @@ exit 0
 
 
 %changelog
+* Tue Dec 13 2022 xinghe <xinghe2@h-partners.com> - 8.17.1-6
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC: fix sendmail.pem unsafe
+
 * Wed Oct 12 2022 yanglu<yanglu72@h-partners.com> - 8.17.1-5
 - Type:bugfix
 - ID:NA