Hello, Indeed this glob works:
/etc/letsencrypt/live/*/privkey.pem r, /etc/letsencrypt/archive/** r,However a more global glob like this might be more useful (for example for old Let's encrypt version when directory is 700):
/etc/letsencrypt/live/** r, /etc/letsencrypt/archive/** r, Thank you.

