ti-guru@localhost:~$ sudo nextcloud.enable-https lets-encrypt
In order for Let's Encrypt to verify that you actually own the
domain(s) for which you're requesting a certificate, there are a
number of requirements of which you need to be aware:

1. In order to register with the Let's Encrypt ACME server, you must
   agree to the currently-in-effect Subscriber Agreement located
   here:

       https://letsencrypt.org/repository/

   By continuing to use this tool you agree to these terms. Please
   cancel now if otherwise.

2. You must have the domain name(s) for which you want certificates
   pointing at the external IP address of this machine.

3. Both ports 80 and 443 on the external IP address of this machine
   must point to this machine (e.g. port forwarding might need to be
   setup on your router).

Have you met these requirements? (y/n) y
Please enter an email address (for urgent notices or key recovery): MY.EMAIL@gmail.com
Please enter your domain name(s) (space-separated): cloud.MYDOMAIN.COM
Attempting to obtain certificates... error running certbot:

Saving debug log to /var/snap/nextcloud/current/certs/certbot/logs/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for cloud.MYDOMAIN.COM
Using the webroot path /var/snap/nextcloud/current/certs/certbot for all domains.
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. cloud.MYDOMAIN.COM (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://cloud.MYDOMAIN.COM/.well-known/acme-challenge/<LONG ACME KEY>: Timeout
IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: cloud.MYDOMAIN.COM
   Type:   connection
   Detail: Fetching
   http://cloud.MYDOMAIN.COM/.well-known/acme-challenge/<LONG ACME KEY>:
   Timeout

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A record(s) for that domain
   contain(s) the right IP address. Additionally, please check that
   your computer has a publicly routable IP address and that no
   firewalls are preventing the server from communicating with the
   client. If you're using the webroot plugin, you should also verify
   that you are serving files from the webroot path you provided.
 - Your account credentials have been saved in your Certbot
   configuration directory at
   /var/snap/nextcloud/current/certs/certbot/config. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
ti-guru@localhost:~$