Is there a FQDN we can apply to geo-restricted port fowards for the cert renewals?

No, Let's Encrypt auth servers try from various points around the world. There would not be one FQDN for each of those possible IP addresses. They also only make outbound requests so there is no need for their IP to be listed in public DNS anyway.

If HTTP Challenge is not viable for you then a DNS Challenge or TLS-ALPN could be used.

A good background on LE validation is: Multi-Perspective Validation & Geoblocking FAQ

5 Likes