"External" certificate

[Eirikr70]

Hello,
I am setting up an ejabberd server with docker. I get my certificate through my reverse-proxy (linuxserver/swag) on another host. I make it available through an nfs share to the ejabberd host and mount it as a volume in the container. But I have a problem of permission since the private key should be read by ejabberd user, and is readable only by root. I then get

[error] Failed to read PEM file /letsencrypt/privkey1.pem: permission denied
[critical] ejabberd initialization was aborted due to invalid certificates configuration

Should I make it publicly readable (which seems to introduce a vulnerability) ?
Thanks, Eric

[Eirikr70]

Additionally, even if I make it publicly readable, it is considered signed by unknown CA although signed by Letsencrypt.

[Eirikr70]

I have deactivated acme challenge and it seems to be working. Sorry for disturbing.