Okay, this fix the problem.
ls -ld /opt/
drwxr-xrwx 5 root root 4096 Mär 11 2018 /opt/
maik@dagobert:~$ sudo chmod 755 /opt/
maik@dagobert:~$ /opt/letsencrypt/certbot-auto --version
Requesting to rerun /opt/letsencrypt/certbot-auto with root privileges...
certbot 0.40.1
But isn't that too far-reaching? I can understand that the letsencrypt folder still needs write protection, but folders above?