I once wasted 2 hours on getting an ssl cert working on an irc server by just giving its user access to my nginx certs, which turned out to also need +x. That was when I realized everything I knew about the execute permission was wrong.