Certificate renewal communication via HTTP with which LE sources?

[danb35]

@humke

Is it true that port 80 needs to remain open for automatic cert renewal to happen?

Yes, that's correct.

@humke

Is there a way to verify/know that the 2 FQDNs are indeed all the servers that LE uses during renewal communication?

No, there is not; this is explicitly not the case. See:

Stuck due to recent changes -- using a Firewall and DNS-01 not possible

…