Getting a certificate when only US inbound traffic is allowed

Help
1

I have a setup where only US inbound traffic is allowed, and I'm not able to get a certificate with TLS-ALPN-01

# acme.sh --issue --alpn -d example-my-domain.com --staging --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx"
[Sun Oct 11 07:37:45 PM EDT 2026] Using ACME_DIRECTORY: https://acme-staging-v02.api.letsencrypt.org/directory
[Sun Oct 11 07:37:47 PM EDT 2026] Using CA: https://acme-staging-v02.api.letsencrypt.org/directory
[Sun Oct 11 07:37:47 PM EDT 2026] Running pre hook:'systemctl stop nginx'
[Sun Oct 11 07:37:47 PM EDT 2026] Standalone alpn mode.
[Sun Oct 11 07:37:47 PM EDT 2026] Single domain='example-my-domain.com'
[Sun Oct 11 07:37:51 PM EDT 2026] Getting webroot for domain='example-my-domain.com'
[Sun Oct 11 07:37:51 PM EDT 2026] Verifying: example-my-domain.com
[Sun Oct 11 07:37:51 PM EDT 2026] Starting tls server.
[Sun Oct 11 07:37:53 PM EDT 2026] Pending. The CA is processing your order, please wait. (1/30)
[Sun Oct 11 07:37:57 PM EDT 2026] Pending. The CA is processing your order, please wait. (2/30)
[Sun Oct 11 07:38:01 PM EDT 2026] Pending. The CA is processing your order, please wait. (3/30)
[Sun Oct 11 07:38:05 PM EDT 2026] example-my-domain.com: Invalid status. Verification error details: During secondary validation: <server IP>: Timeout during connect (likely firewall problem)
[Sun Oct 11 07:38:05 PM EDT 2026] Running post hook: 'systemctl start nginx'

I went through this thread Question on renewal and what Countries are connecting - #6 by Warezkid and it says validation comes from the USA, Sweden and Singapore. With only US traffic allowed, how can I get the certificate?

Thanks

2

Are your DNS servers available world-wide?

If so, use a DNS Challenge to get a cert. Otherwise you won't be able to and not from other publicly trusted CA either. Multi-perspective validation is required by industry standards.

An excellent writeup is: Multi-Perspective Validation & Geoblocking FAQ

3

As recently it become rule to CAs validate domains from multiple continents you won't get cert from anywhere while geoblocked to just US.
CA/B baseline requirement 3.2.2.9

Effective 2026‐06‐15, the CA MUST implement Multi‐Perspective Issuance Corroboration
using at least four (4) remote Network Perspectives. The CA MUST ensure that the
requirements defined in Quorum Requirements Table are satisfied, and the remote Network
Perspectives that corroborate the Primary Network Perspective fall within the service
regions of at least two (2) distinct Regional Internet Registries. If the requirements are not
satisfied, then the CA MUST NOT proceed with issuance of the Certificate