How to use certs in non-root services?

Another revival for the specific issue OP had (and that I had discovering this thread)
Prosody now specifically makes this easier for let’s encrypt

https://prosody.im/doc/letsencrypt
Using Prosody 0.10

prosodyctl --root cert import /etc/letsencrypt/live

Or using certbot’s deploy hook

certbot renew --deploy-hook "prosodyctl --root cert import /etc/letsencrypt/live"