The ACME challenge directory was created with group 'acme' but nginx needs read access to serve challenge responses. Setting defaults.group to 'nginx' ensures all ACME directories are accessible by nginx.