I think the relevant part here is that remote hosts have public IPs. I'm assuming you're doing HTTP-01 verification on Lets Encrypt, which does basically requir

I think the relevant part here is that remote hosts have public IPs. I'm assuming you're doing HTTP-01 verification on Lets Encrypt, which does basically require a public IP. FYI, you can get Lets Encrypt certs easily on non-public hosts by using the DNS-01 challenges. They rely on setting particular DNS records rather than HTTP responses, so they don't rely on public IPs