**Build scan:**
https://gradle-enterprise.elastic.co/s/o5fyjoyg4nmrk/tests/:qa:os:destructiveDistroTest.default-deb/org.elasticsearch.packaging.test.CertGenCliTests/test10Install

**Reproduction line:**
```
null
```

**Applicable branches:**
main

**Reproduces locally?:**
Didn't try

**Failure history:**
https://gradle-enterprise.elastic.co/scans/tests?tests.container=org.elasticsearch.packaging.test.CertGenCliTests&tests.test=test10Install

**Failure excerpt:**
```
java.lang.AssertionError: 
Expected: "file/directory: "<File> with owner "root" with group "root" with posix permissions [<OWNER_READ>,<OWNER_WRITE>,<GROUP_READ>,<OTHERS_READ>]
     but: path </usr/share/elasticsearch/NOTICE.txt>Has permissions [GROUP_WRITE, OWNER_READ, OWNER_WRITE, GROUP_READ, OTHERS_READ]

  at __randomizedtesting.SeedInfo.seed([49D09F0DDE208AB3:A58A93F582B035E9]:0)
  at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:18)
  at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:6)
  at org.elasticsearch.packaging.util.Packages.lambda$verifyOssInstallation$12(Packages.java:214)
  at java.util.Spliterators$ArraySpliterator.forEachRemaining(Spliterators.java:1006)
  at java.util.stream.ReferencePipeline$Head.forEach(ReferencePipeline.java:762)
  at org.elasticsearch.packaging.util.Packages.verifyOssInstallation(Packages.java:214)
  at org.elasticsearch.packaging.util.Packages.verifyPackageInstallation(Packages.java:176)
  at org.elasticsearch.packaging.test.PackagingTestCase.install(PackagingTestCase.java:245)
  at org.elasticsearch.packaging.test.CertGenCliTests.test10Install(CertGenCliTests.java:51)
  at jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
  at java.lang.reflect.Method.invoke(Method.java:578)
  at com.carrotsearch.randomizedtesting.RandomizedRunner.invoke(RandomizedRunner.java:1758)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$8.evaluate(RandomizedRunner.java:946)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$9.evaluate(RandomizedRunner.java:982)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$10.evaluate(RandomizedRunner.java:996)
  at org.junit.rules.TestWatcher$1.evaluate(TestWatcher.java:55)
  at org.junit.rules.TestWatcher$1.evaluate(TestWatcher.java:55)
  at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl$StatementRunner.run(ThreadLeakControl.java:390)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl.lambda$forkTimeoutingTask$0(ThreadLeakControl.java:850)
  at java.lang.Thread.run(Thread.java:1623)

```
qa/os/src/test/java/org/elasticsearch/packaging/test/CertGenCliTests.java
}
    @AwaitsFix(bugUrl = "https://github.com/elastic/elasticsearch/issues/99153")
    public void test31ExtractCerts() throws Exception {
        
        assumeFalse(Platforms.OS_NAME.equals("Windows Server 2012 R2"));
        Path certsDir = installation.config("certs");
        sh.extractZip(certificatesFile, certsDir);
        Path caDir = certsDir.resolve("ca");
        assertThat(caDir.resolve("ca.key"), file(File, null, null, null));
        assertThat(caDir.resolve("ca.crt"), file(File, null, null, null));
        Path nodeDir = certsDir.resolve("mynode");
        assertThat(nodeDir.resolve("mynode.key"), file(File, null, null, null));
        assertThat(nodeDir.resolve("mynode.crt"), file(File, null, null, null));
        FileUtils.cp(certsDir, installation.config("certs"));
    }
    @AwaitsFix(bugUrl = "https://github.com/elastic/elasticsearch/issues/99153")
    public void test40RunWithCert() throws Exception {
        
        assumeFalse(Platforms.OS_NAME.equals("Windows Server 2012 R2"));
        final String keyPath = escapePath(installation.config("certs/mynode/mynode.key"));
        final String certPath = escapePath(installation.config("certs/mynode/mynode.crt"));
        final String caCertPath = escapePath(installation.config("certs/ca/ca.crt"));
        final Settings settings = Settings.builder().loadFromPath(installation.config("elasticsearch.yml")).build();
        
        
        
        final Settings newSettings = Settings.builder()
            .put(
                settings.filter(k -> k.startsWith("xpack.security") == false)
                    .filter(k -> k.equals("node.name") == false)