Defguard 2.0 built-in Let’s Encrypt with External URL on port 8443

[minimalguru-dev]

Hello,

We are running Defguard 2.0.2 with Core and Gateway on one internal VM and Edge on a separate DMZ VM.

Public TCP 443 is used by another production service, so Defguard cannot use it directly. Currently, nginx listens on Edge TCP 8443 and certificates are issued with acme.sh using DNS-01, then securely copied from Core to Edge.

Could you please confirm:

1. Is this configuration officially supported?

   Public TCP 80 -> Edge TCP 80 for HTTP-01
   Public TCP 8443 -> Edge TCP 443 for Defguard HTTPS

2. Will enrollment, Desktop Client communication and automatic certificate renewal work correctly with the External URL on port 8443?

3. Does public TCP 80 need to remain permanently forwarded for renewals?

4. Does Defguard require public TCP 443 at any point, even when the configured External URL uses port 8443?

5. Does the built-in certificate functionality support ACME DNS-01 challenges instead of HTTP-01, either currently or on the roadmap?

Best regards