Letsencrypt auto renew port

1. Does Certbot renew need port 80?
2. Is it OK to leave port 80 open?
3. What ports does LetsEncrypt use?

Does Certbot renew need port 80?

If you're using any Certbot with any method other than DNS authentication, your web server must listen on port 80, or at least be capable of doing so temporarily during certificate validation.

Is it OK to leave port 80 open?

Port 80 isn't inherently a security risk. However, if you leave it open and don't have the proper configurations in place, attackers can easily use it to access your systems and data. Unlike port 443 (HTTPS), port 80 is unencrypted, making it easy for cybercriminals to access, leak and tamper with sensitive data.

What ports does LetsEncrypt use?

Per Challenge Types - Let's Encrypt : Our implementation of the HTTP-01 challenge follows redirects, up to 10 redirects deep. It only accepts redirects to “http:” or “https:”, and only to ports 80 or 443. It does not accept redirects to IP addresses.