The ACME client generates the private key to keep and a signing request to send to the CA. Once the CA validates your challenge type, the client requests the signed cert over that same channel. It doesn’t interact with 80 or 443 except to complete challenges.

If you update DNS, that would use DNS-01 challenge and you don’t need port 80 open. I am using this challenge type to generate certs for completely internal services. The only reason to have 80 open would be to use HTTP-01 challenge, which requires your server to host a file on a specific url only via port 80. If your service is already public on 443, you could leave port 80 open with a simple http-to-https redirect.

Port 443 would need to be open if you want to use TLS-ALPN-01 challenge, but I would avoid this as it is not easy to use or configure.

My advice for internal services is to setup only DNS-01 challenge and configure your dns to be automatically updated using a dns plug-in. This should almost never fail validation.

Most of these backup solutions try to reduce the amount of data backed up, so the system will process each file and determine if the contents changed and only upload new data. In this case if you modify the file you may end up with 2 16 MB chunks that have slightly different data, and only when the old backup expires and the pruning process completes would one of those chunks be deleted.

Smaller chunks sizes means you get more files written to S3, but less duplicate data when deduping without compression.