You don’t need port 80 open, you can do DNS based challenge.

1) Transfer your domain to someone who provides a DNS API like DigitalOcean or Cloudflare

2) download the appropriate plugin for certbot (certbot-dns-digitalocean, certbot-dns-cloudflare)

3) get an API token and config the plugin with it

4) set up a post-renew-hook to do a `service nginx reload` to reload the new cert

sample instructions for DO https://www.digitalocean.com/community/tutorials/how-to-acqu...