How does this meme keep getting repeated over and over and over when it was wrong the day LE launched? It doesn't even make sense if you just think about it. Why would you need root access to make some HTTP calls? Most ACME clients don't require root. The one-click-and-reconfigure-my-webserver obviously requires root.

Certbot defaults to a path on your system that requires root, and sets permissions so non-root users can't look at your private keys.

If you would like to use it without root/sudo, you can pass flags changing the directory it uses. For example:

    certbot --logs-dir ~/SSL --work-dir ~/SSL --config-dir ~/SSL

There are alternative clients one can use like acme_tiny.