Certificate Permission

[hulala]

Hi,
I just installed roundcube and everything works fine, but I was wondering about the permission for my certificate and key files. I can only login, if www-data (nginx user) has the permission to read the certificate (else I get  "failed loading cafile"). And for sending mails www-data even needs permission to read the key, else I get SMTP Error (454). Is this normal? I always thought that only root should be able to read this, but I am obviously not well educated.
Thank you very much!

Edit: After trying a bit, I figured out that it is enough when exim has the permission to read key file, but I still don't know whether that is ok.