[adev_]

> How does Traefik get its LetsEncrypt certificate from behind the firewall when LetsEncrypt can't see Traefik?

DNS registration. You can get letsencrypt validation through a DNS token for validation. You can generally script that using the API provided by your DNS provider.

[adamcstephens]

With Traefik it’s just setting up the config and any authentication. After that Traefik will manage the lifecycle of the cert.