They keep trying to push the idea that letsencrypt should be ran as root. If you disagree with that, I ran it as a normal user using:

    letsencrypt -t --work-dir /tmp --logs-dir /tmp \ 
    certonly --webroot /www/public -d example.com

Except on my system the letsencrypt command did not work. It failed with an "Operation not permitted". So I edited the webroot.py file, and commented out line 108 that said:

    # Remove execution bit (not needed for this file)
    os.chmod(path, filemode & ~stat.S_IEXEC)

It ran fine without root, sudo, or su.

Then I added this to nginx.conf:

    listen 443 ssl http2;
    ssl_certificate /usr/local/etc/letsencrypt/live/example.com/fullchain.pem
    ssl_certificate_key /usr/local/etc/letsencrypt/live/example.com/privkey.pem

It gets an A+ on ssllabs.com, and it works fine in the browser. When I click the lock it says "Let's Encrypt".