Everyone that uses letsencrypt has a cron installed to auto-renew. Certbot needs two permissions to work: 1. perform the necessary verification, of which there

Everyone that uses letsencrypt has a cron installed to auto-renew. Certbot needs two permissions to work: 1. perform the necessary verification, of which there are many, placing a file on your website is just one possibility. 2. place the generated certificates in some location where the webserver can read them. Neither of these steps requires root if you know what youre doing.