Icinga2 pki new-ca fails

I am trying to create a new ca since our key has been lost. I run the ‘icinga2 pki new-ca’ command and get the following error.

information/base: Writing private key to ‘/var/lib/icinga2/ca/ca.key’.
critical/SSL: Error while opening private RSA key file ‘/var/lib/icinga2/ca/ca.key’: 33558541, “error:0200100D:
system library:fopen:Permission denied”
critical/Application: Error: std::exception

Additional information is available in ‘/var/log/icinga2/crash/report.1620074959.266137’

The ca.crt file is created but the ca.key file is not. Any help would be appreciated.

I solved this issue by changing the /var/lib/icinga2/ca directories ownership to nagios:nagios