Failure to poke my webserver from Cerbot servers

What you're calling "Certbot servers" are, in this case, "Let's Encrypt's servers". Let's Encrypt is the default certificate authority (CA) that certbot uses, though you can configure it to use another one instead. All CAs need to check from multiple locations, though perhaps some only check from within Europe for now. Let's Encrypt does do checks from Europe, in addition to other locations.

If you're specifically looking for a CA based in Europe rather than the US, you might want to consider BuyPass GO which is based in Oslo. Using it would just involve adding --server https://api.buypass.com/acme/directory to a certbot command used to get you a certificate. However, just because it's based in one place doesn't mean that's the only place it validates control of domain names from. Like I said, all CAs will need to check from multiple locations, and requirements are getting more strict (meaning requiring even more locations) over time.

As that FAQ states, generally one needs to allow for traffic that validates your control over the name, even if blocking other traffic. But specifics will depend on exactly what you're trying to block how and why.

5 Likes