Let's Encrypt needs to connect to your server, from multiple places around the world, in order to validate that you actually control your domain name and that it's not an attacker who can control the domain name from just some parts of the Internet. This FAQ may help you:
3 Likes