I have successfully configured Letsencrypt for my NGINX webserver on Debian 8 Jessie.

Now I have installed Postgresql 9.4 and want to use the LE certificates (in /etc/letsencrypt/live/mydomain/com/...) for its SSL connection. I've set the paths to the certificate and the key in the config file ( /etc/postgresql/9.4/main/postgresql.conf).

Predictably when I try to restart Postgres via pg_ctlcluster it fails because of Permission denied to the certificate. I understand that Postgresql is run with the user postgres and that this user does not have access to this directory.

How do I fix this in a clean way?


You can either add the posrgres user to the wheel group or a different group that can have access to the directory /etc/letsencrypt/live/mydomain/com/ or make the postgres user owner of the certificate (if is used exclusively).

Example command to make the postgres owner to a hypothetical location

sudo mkdir /etc/postgres/
sudo mv /etc/letsencrypt/live/mydomain/com/pg.crt /etc/postgres/pg.crt
sudo mv /etc/letsencrypt/live/mydomain/com/pg.key /etc/postgres/pg.key
sudo chown -R postgres: /etc/postgres

Then you need to adjust the /etc/postgresql/9.4/main/postgresql.conf to point to the new path.

  • 8
    LetsEncrypt certs must be renewed every 2 months, so it's not a good idea to just move the files. Better tell Postgres to use the /etc/letsencrypt/live/* location directly. – Adrien Jun 11 '17 at 11:45
  • You can use a certbot hook to run a script that copies the certificate and private key and chowns them on every renewal. (Moving the symlinks from /etc/letsencrypt/live is unlikely to help, the files they point to will still be unreadable for non-root users.) – Marius Gedminas Dec 20 '18 at 13:14

or add an acl to the directory the key is stored in (make it the default acl so that it wil work when new files are added) PS: The directory you need to set the acl on is (at least on centos) /etc/letsencrypt/archove/[your fqdn here] as the files in /etc/letsencrypt/live/[your fqdn here] are just symlinks

  • Please proofread your answer. – Andrew Schulman Mar 1 '18 at 13:58
  • thanks, have just done so, sorry for the earlyer typos, it is strange how typos are so mouch easier to spot a few days later – Bjarne Nilsson Mar 3 '18 at 11:49
  • "archove" is still misspelt ;) – Marius Gedminas Dec 20 '18 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.