elasticsearch cannot read certificate file - linux file permissions

I generated a certificate file with certbot. It is placed in /etc/letsencrypt/.... I created a group called elk where I added the elasticsearch user, and I recursively set it as the owning group for /etc/letsencrypt and recursively set the permissions to 770. When I start elasticsearch via systemctl start elasticsearch.service, it is not able to read the file? `Caused by: java.security.AccessControlException: access denied ("java.io.FilePermission" "/etc/letsencrypt/live//fullchain.pem" "read") ` Why is that? What strategy would you recommend to be able to use the same certificate for elasticsearch and kibana?