> -rw------- 1 root root 1708 Dec 13 11:05 ./keys/0000_key-certbot.pem > Anything wrong in here? Your configure line includes early-droproot. Your command line includes -u ntp:ntp With that combination, it's probably trying to read the key after switching to user ntp. -- These are my opinions. I hate spam.