@xabean The short answer to your questions are essentially “Because of the changes to web PKI certificate lifetimes everyone will need to automate with ACME. When using Let’s Encrypt that requires your server to make outbound connections to (essentially) the internet. How do I restrict CertBot to only talk to the DNS name for let’s encrypt and only to deal with the challenge?”