@p hey the majority of letsencrypt certs are done with certbot running as root, because how would you reload servers without root.