diff --git a/cyrus-imapd-init.service b/cyrus-imapd-init.service
index e7a2611..650f451 100644
--- a/cyrus-imapd-init.service
+++ b/cyrus-imapd-init.service
@@ -7,5 +7,6 @@ ConditionPathExists=!/etc/pki/cyrus-imapd/cyrus-imapd-ca.pem
 
 [Service]
 Type=oneshot
+Group=mail
 RemainAfterExit=no
 ExecStart=/usr/bin/sscg --package cyrus-imapd --cert-file /etc/pki/cyrus-imapd/cyrus-imapd.pem --cert-key-file /etc/pki/cyrus-imapd/cyrus-imapd-key.pem --ca-file /etc/pki/cyrus-imapd/cyrus-imapd-ca.pem
diff --git a/cyrus-imapd.spec b/cyrus-imapd.spec
index d359f54..ac8441a 100644
--- a/cyrus-imapd.spec
+++ b/cyrus-imapd.spec
@@ -9,7 +9,7 @@
 
 Name: cyrus-imapd
 Version: 3.0.9
-Release: 1%{?dist}
+Release: 2%{?dist}
 
 %define ssl_pem_file /etc/pki/%name/%name.pem
 
@@ -693,6 +693,9 @@ getent passwd cyrus >/dev/null || /usr/sbin/useradd -c "Cyrus IMAP Server" -d /v
 
 
 %changelog
+* Thu May 16 2019 Pavel Zhukov <pzhukov@redhat.com> - 3.0.9-2
+- Run sscg as mail group for proper certs permissions
+
 * Thu Mar 14 2019 Jason L Tibbitts III <tibbs@math.uh.edu> - 3.0.9-1
 - Update to 3.0.9.