certbot doesn't need root, it just writes to directories that are usually limited to root by default (`/etc/`, `/var/log/`, `/var/lib/`). And it needs some inte

certbot doesn't need root, it just writes to directories that are usually limited to root by default (`/etc/`, `/var/log/`, `/var/lib/`). And it needs some interaction with the web server to actually complete the challenge. You can absolutely provide it with alternative paths and configure your web server to forward `/.well-known/acme-challenge/` to a non-root location.