I have not done any tests to confirm this, but here’s what I think ought to be the the minimum set of firewall rules you need for Let’s Encrypt:
- For all challenge types: Allow outgoing traffic to
acme-v01.api.letsencrypt.org on port 443 (HTTPS).
HTTP-01 (for example via
certbot's webroot plugin): Allow incoming traffic on port 80 (HTTP) from anywhere.
TLS-SNI-01 (for example via
certbot's standalone or apache plugin - this is probably what you used, if I’m interpreting “automated install” correctly): Allow incoming traffic on port 443 (HTTPS) from anywhere.
In case you’re wondering why it’s “anywhere” for
TLS-SNI-01, and not a set of specific IPs: Let’s Encrypt plans to perform validation requests from a number of (possibly) unpredictable IP addresses in the future, in order to make spoofing validation requests harder. If you rely on a specific IP address being used, your deployment will break without any warning at some point.
If you’re looking for a challenge type that does not require allowing any incoming traffic, take a look at
DNS-01. With that challenge type, domain ownership is demonstrated via a TXT record you create for your domain. Note that this is currently not supported by
certbot, you’d have to use one of the alternative clients (take a look at lego or any of the bash clients).