They keep trying to push the idea that letsencrypt should be ran as root. If you disagree with that, I ran it as a normal user using:<p><pre><code>    letsencrypt -t --work-dir &#x2F;tmp --logs-dir &#x2F;tmp \ 
    certonly --webroot &#x2F;www&#x2F;public -d example.com
</code></pre>
Except on my system the letsencrypt command did not work. It failed with an &quot;Operation not permitted&quot;. So I edited the webroot.py file, and commented out line 108 that said:<p><pre><code>    # Remove execution bit (not needed for this file)
    os.chmod(path, filemode &amp; ~stat.S_IEXEC)
</code></pre>
It ran fine without root, sudo, or su.<p>Then I added this to nginx.conf:<p><pre><code>    listen 443 ssl http2;
    ssl_certificate &#x2F;usr&#x2F;local&#x2F;etc&#x2F;letsencrypt&#x2F;live&#x2F;example.com&#x2F;fullchain.pem
    ssl_certificate_key &#x2F;usr&#x2F;local&#x2F;etc&#x2F;letsencrypt&#x2F;live&#x2F;example.com&#x2F;privkey.pem
</code></pre>
It gets an A+ on ssllabs.com, and it works fine in the browser. When I click the lock it says &quot;Let&#x27;s Encrypt&quot;.