&gt; They keep trying to push the idea that letsencrypt should be ran as root.<p>When you say it that way, it sounds like there&#x27;s something untoward going on. ;)<p>From what I understand, the official client <i>can</i> bind to port 80 to do Basic HTTP verification. This requires root privs. The official client can also update many HTTP server config files. I guess you don&#x27;t need to be root to do this, but it does remove a command line flag. LE is designed to be stupidly simple, but -as you&#x27;ve discovered- it does let more technical users run it in safer modes of operation.<p>&gt; Except on my system the letsencrypt command did not work. It failed with an &quot;Operation not permitted&quot;.<p>Odd. If I&#x27;m reading the code correctly, it looks like you have to have write and create privs to &#x27;path&#x27;, so it&#x27;s odd that you wouldn&#x27;t also be able to remove the execute bit.<p>Regardless, would you file a bug about this or -at least- bring it up on the mailing list? It&#x27;s possible that this is user error, but if it&#x27;s not, I expect that it&#x27;s something the LE guys would like to hear about.