Configure the firewall before trying to get the X509 certificates.

library/bootstrap-roles/deb-ubuntu-common/meta/main.yml

@@ -2,10 +2,10 @@
 dependencies:
   - role: '../../library/roles/ubuntu-deb-general'
   - { role: '../../library/roles/cloud-init', when:  ansible_product_name == "oVirt Node" }
+  - role: '../../library/roles/iptables'
   - { role: '../../library/roles/data_disk', when: additional_disks is defined and additional_disks }
   - role: '../../library/roles/sshd_config'
   - { role: '../library/roles/letsencrypt-acme-sh-client', when: letsencrypt_acme_sh_install is defined and letsencrypt_acme_sh_install }
-  - role: '../../library/roles/iptables'
   - { role: '../../library/roles/nagios', when: nagios_enabled is defined }
   - { role: '../../library/roles/prometheus-node-exporter', when: prometheus_enabled }