Let's encrypt SSL couldn't start by “Error: EACCES: permission denied, open '/etc/letsencrypt/live/domain.net/privkey.pem'”

Question

I tried to use SSL by Node.js but it doesn\'t work because permission denied.

try {
var TLSoptions = {
    key: fs.readFileSync(\"/etc/letsencry         


        

Answer 1

When you use sudo to issue the certificates, they will be owned by root. Since node is not run as root, and the permissions on the certificate folder do not allow them to be opened by anyone except the owner, your node app cannot see them.

To understand the solution, let us assume node is running as the user nodeuser

Solution #1 (temporary):
You could switch the owner of the certificates to your node user.
$ sudo chown nodeuser -R /etc/letsencrypt
However, this may break any other items that look at the cert, such as Nginx or Apache.
It will also only last till your next update, which is no more than 90 days. On the other hand, whatever script you have that renews the cert can also set the owner.

Solution #2 (do not do this):
Run node as root.
sudo node index.js
This will run node as a root user, which means that the terribly insecure surface of node can access everything on your system. Please don't do this.

Solution #3 (do not do this either):
Open the certificates to everyone.
The certificates are stored in /etc/letsencrypt/archive/${domain}/cert1.pem, and are linked to from /etc/letsencrypt/live/${domain}/cert1.pem.

All folders in both of these paths are +x, meaning that all users on the system can open the folders, with the exception of the "live" and "archive" folders themselves.
You can make those open as well by changing their permissions.

$ sudo chmod +x /etc/letsencrypt/live
$ sudo chmod +x /etc/letsencrypt/archive

This is bad as it allows access from other unexpected sources. Generally opening folders to everyone is a bad idea.

Solution #4 (do this):
On the other hand, you can create a limited group, and allow the permissions to only be opened for them.

// Create group with root and nodeuser as members
$ sudo addgroup nodecert
$ sudo adduser nodeuser nodecert
$ sudo adduser root nodecert

// Make the relevant letsencrypt folders owned by said group.
$ sudo chgrp nodecert /etc/letsencrypt/live
$ sudo chgrp nodecert /etc/letsencrypt/archive

// Allow group to open relevant folders
$ sudo chmod 710 /etc/letsencrypt/live
$ sudo chmod 710 /etc/letsencrypt/archive

That should allow node to access the folders with the certs, while not opening it to anyone else.

You should then reboot or at least logout and in after these changes.
(Many changes to permission and groups require a new session, and we had issues with PM2 until reboot.)

Answer 2

I'm not familiar with Node.js, but it's clearly the same permissions problem as with PostgreSQL. So the same solution should work fine. This allows you to leave the permissions on /etc/letsencrypt as they are :

• copy the certificates to your Node.js directory
• chown the copied files to your "node" user

You can have a script doing that in /etc/letsencrypt/renewal-hooks/deploy which will be called everytime you renew your certificates.

Example /etc/letsencrypt/renewal-hooks/deploy/10-certbot-copy-certs :

#!/bin/bash

domain=domain.work # using your example name
node_dir=/path/to/cert_copies
node_user=nodeuser

cp /etc/letsencrypt/live/$domain/{fullchain,privkey}.pem "$node_dir"/
chown $node_user "$node_dir"/*.pem