chown :ssl-cert /etc/letsencrypt/{archive,live}
chmod g+rx /etc/letsencrypt/{archive,live}