diff --git a/install.sh b/install.sh
index 11aa02e..798196d 100755
--- a/install.sh
+++ b/install.sh
@@ -201,12 +201,17 @@ for fpm_svc in /lib/systemd/system/php*-fpm.service /usr/lib/systemd/system/php*
         cat << 'EOF_OVERRIDE' > "/etc/systemd/system/${svc_name}.d/override.conf"
 [Service]
 ProtectSystem=false
-ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log /var/lib/asterisk /var/spool/asterisk /var/www /usr/local/bin /etc/sudoers.d
+ReadWritePaths=/etc/asterisk /etc/fail2ban /etc/nginx /var/log /var/lib/asterisk /var/spool/asterisk /var/www /usr/local/bin /etc/sudoers.d /etc/letsencrypt /var/lib/letsencrypt
 EOF_OVERRIDE
     fi
 done
 systemctl daemon-reload
 
+# Répertoires Let's Encrypt et permissions pour Asterisk / Web
+mkdir -p /etc/letsencrypt /var/log/letsencrypt /var/lib/letsencrypt
+chgrp -R asterisk /etc/letsencrypt 2>/dev/null || true
+chmod -R g+rX /etc/letsencrypt 2>/dev/null || true
+
 # Configuration des limites d'upload PHP (Restauration d'archives 512 Mo & Sons volumineux)
 for php_dir in /etc/php/*; do
     if [ -d "$php_dir/fpm/conf.d" ]; then
diff --git a/scripts/fix.sh b/scripts/fix.sh
index 0e1a3dd..ce32145 100755
--- a/scripts/fix.sh
+++ b/scripts/fix.sh
@@ -57,7 +57,9 @@ echo "-> Droits applicatifs et ACL POSIX (/etc/asterisk et /var/www/nexus-pbx)..
 usermod -aG asterisk www-data 2>/dev/null || true
 usermod -aG www-data asterisk 2>/dev/null || true
 
-mkdir -p /var/www/nexus-pbx/public/avatars /var/www/nexus-pbx/storage/sounds /var/www/nexus-pbx/storage/backups /var/www/nexus-pbx/storage/system_backups
+mkdir -p /var/www/nexus-pbx/public/avatars /var/www/nexus-pbx/storage/sounds /var/www/nexus-pbx/storage/backups /var/www/nexus-pbx/storage/system_backups /etc/letsencrypt /var/log/letsencrypt /var/lib/letsencrypt
+chgrp -R asterisk /etc/letsencrypt 2>/dev/null || true
+chmod -R g+rX /etc/letsencrypt 2>/dev/null || true
 chown -R www-data:asterisk /var/www/nexus-pbx
 chmod 2775 /var/www/nexus-pbx/storage /var/www/nexus-pbx/storage/backups /var/www/nexus-pbx/storage/system_backups /var/www/nexus-pbx/storage/sounds /var/www/nexus-pbx/public/avatars 2>/dev/null || true
 
diff --git a/scripts/update.sh b/scripts/update.sh
index 1784317..56e646e 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -96,6 +96,9 @@ echo -e "${C_GRAY}[2/6] Déploiement des nouveaux fichiers de code...${C_RESET}"
 git reset --hard FETCH_HEAD 2>/dev/null || git reset --hard "${GIT_REMOTE}/${GIT_BRANCH}"
 chown -R www-data:asterisk "$APP_DIR" 2>/dev/null || true
 chmod 2775 "$APP_DIR/storage" "$APP_DIR/storage/backups" "$APP_DIR/storage/sounds" 2>/dev/null || true
+mkdir -p /etc/letsencrypt /var/log/letsencrypt /var/lib/letsencrypt 2>/dev/null || true
+chgrp -R asterisk /etc/letsencrypt 2>/dev/null || true
+chmod -R g+rX /etc/letsencrypt 2>/dev/null || true
 chmod +x "$APP_DIR/scripts/update.sh" "$APP_DIR/scripts/nexus-firewall" "$APP_DIR/scripts/nexus-banner.sh" 2>/dev/null || true
 
 # Liens symboliques CLI (non-bloquants si exécuté sous sandbox PHP ProtectSystem)
diff --git a/src/CertificateManager.php b/src/CertificateManager.php
index af258b9..0f1d308 100644
--- a/src/CertificateManager.php
+++ b/src/CertificateManager.php
@@ -265,8 +265,9 @@ class CertificateManager
 
         $stagingFlag = $staging ? '--test-cert' : '';
 
-        // Exécution de Certbot webroot non-interactive (Clé RSA 2048 universellement compatible téléphones IP Yealink/Fanvil/Grandstream)
-        $cmd = "certbot certonly --webroot -w {$escWebroot} -d {$escDomain} --non-interactive --agree-tos -m {$escEmail} --keep-until-expiring --key-type rsa --rsa-key-size 2048 {$stagingFlag} 2>&1";
+        // Exécution de Certbot webroot non-interactive avec sudo (Clé RSA 2048 universellement compatible téléphones IP Yealink/Fanvil/Grandstream)
+        $hookCmd = escapeshellarg("chgrp -R asterisk /etc/letsencrypt 2>/dev/null; chmod -R g+rX /etc/letsencrypt 2>/dev/null || true");
+        $cmd = "sudo /usr/bin/certbot certonly --webroot -w {$escWebroot} -d {$escDomain} --non-interactive --agree-tos -m {$escEmail} --keep-until-expiring --key-type rsa --rsa-key-size 2048 --post-hook {$hookCmd} {$stagingFlag} 2>&1";
 
         $output = [];
         $exitCode = 0;
@@ -444,7 +445,8 @@ class CertificateManager
         $domain = $cert['primary_domain'];
         $escDomain = escapeshellarg($domain);
 
-        $cmd = "certbot renew --cert-name {$escDomain} --force-renewal 2>&1";
+        $hookCmd = escapeshellarg("chgrp -R asterisk /etc/letsencrypt 2>/dev/null; chmod -R g+rX /etc/letsencrypt 2>/dev/null || true");
+        $cmd = "sudo /usr/bin/certbot renew --cert-name {$escDomain} --force-renewal --post-hook {$hookCmd} 2>&1";
         $output = [];
         $exitCode = 0;
         exec($cmd, $output, $exitCode);
diff --git a/version.json b/version.json
index 21d9878..aa7b63a 100644
--- a/version.json
+++ b/version.json
@@ -1,11 +1,11 @@
 {
-  "version": "1.5.1",
+  "version": "1.5.2",
   "codename": "Helios",
   "release_date": "2026-11-04",
   "min_php_version": "8.2",
   "changelog": [
+    "Correction de l'émission et du renouvellement Let's Encrypt / Certbot ACME (privilèges sudo et permissions d'accès aux certificats)",
     "Plafond d'expiration d'enregistrement SIP standard (maximum_expiration = 300s, default = 120s) garantissant la reconnexion automatique rapide de tous les postes (1 à 3 min)",
-    "Support standard PJSIP check-sync et resync sans altération de l'état système",
     "Nettoyage et isolation stricte des sauvegardes (base NexusPBX, sons, spools voicemail, certificats)",
     "Résolution définitive et propre des conflits de préfixes Dialplan sur les SVI/IVR (*801-*899)"
   ]