and that was the production API of letsencrypt.tcl, so I tried to switch it to the staging api. This time, it tried to reach acme-staging.api.letsencrypt.org and pinging it from that machine is also successful, so again the network is -not- unreachable.
