Can’t use letsencrypt certificate

[Geobert]

Hi,

My SWS fails to start:

May 04 14:15:49 geob-server static-web-server[3888]: 2026-05-04T14:15:49.990608588+02:00 ERROR static_web_server::server failed to start up: failed to initialize TLS probably because invalid cert or key file
May 04 14:15:49 geob-server static-web-server[3888]: Caused by:
May 04 14:15:49 geob-server static-web-server[3888]:     failed to parse certificate

I’m using systemd on a Debian 13 using the systemd unit provided as example and customized to my setup

in the env file I made sure the path to both cert and key are correct,

/etc/letsencrypt/live/geobert.fr/fullchain.pem
/etc/letsencrypt/live/geobert.fr/privkey.pem

What should I look after?

private key begins with:

-----BEGIN PRIVATE KEY-----

[Geobert]

openssl is happy

openssl verify -CAfile chain.pem fullchain.pem 
fullchain.pem: OK

openssl ec -check -noout -in privkey.pem 
read EC key
EC Key valid.

[Geobert]

I manage to run it from command line so I think it’s a permission issue on reading the cert or key

[Geobert]

Had to remove DynamicUser=true

I did set SupplementaryGroups to an existing user and/or group with no luck

[joseluisq]

May 04 14:15:49 geob-server static-web-server[3888]: 2026-05-04T14:15:49.990608588+02:00 ERROR static_web_server::server failed to start up: failed to initialize TLS probably because invalid cert or key file
May 04 14:15:49 geob-server static-web-server[3888]: Caused by:
May 04 14:15:49 geob-server static-web-server[3888]: failed to parse certificate

It seems strange, maybe because of the implementation of how we read the cert bundle. It would be great if you could provide more insights to debug. Does the fullchain.pem contain more than one certificate? Do you use a particular tool to generate certs from let's encrypt?

[Geobert]

Thanks for your answer :)

As said above, it’s a permission issue, I work around it by removing DynamicUser=true but sws runs as root

I still have to allocate some time to find how to do that cleanly :)

[joseluisq]

Got it, it was due to permission issues. You may be missing something in the systemd setup because the idea of running it via systemd is to avoid root.

[Geobert]

Yeah ^^ I did put my user in the SupplementaryGroups but the privkey is 700 for root:root but I did try to chmod to geob:www-data with no luck so far

[joseluisq]

I was able to run SWS + TLS on Arch Linux (non-root) via systemd a long time ago, which is why the File descriptor example came about. Check out the Testing section so you can verify if everything works as expected.

Anyway, I will try to revisit that configuration in the next few hours so I can give you some hints.