When cupsd starts, it changes owner, group and permissions
of a SSL certificate to "-rw-r-----  1 lp lp".

If it is a system wide used certificate, other services
can no longer use it.

How to reproduce:
Specify in /etc/cups/cupsd.conf a system wide certificate
(here it is the default system certificate on a SLES9):
----------------------------------------------------------
ServerCertificate /etc/ssl/servercerts/servercert.pem
ServerKey /etc/ssl/servercerts/serverkey.pem
----------------------------------------------------------

For your information:
By default the SLES9 system certificate is
(here on brie.hwlab.suse.de):
----------------------------------------------------------------
brie:~ # ls -ld /etc/ssl/servercerts/*
-rw-r--r--  1 root root ... /etc/ssl/servercerts/servercert.pem
-rw-r-----+ 1 root root ... /etc/ssl/servercerts/serverkey.pem

brie:~ # getfacl /etc/ssl/servercerts/serverkey.pem
getfacl: Removing leading '/' from absolute path names
# file: etc/ssl/servercerts/serverkey.pem
# owner: root
# group: root
user::rw-
user:ldap:r--
group::---
mask::r--
other::---
----------------------------------------------------------------