Run script to open firewall before renewal?

[FreydNot]

I had to manually open port 80 to the world when I created my first cert, and I closed port 80 after the cert was issued. Typical usage is whitelisted access to port 80 only.

When cert renewal time comes around, I'm going to need to open port 80 again. Is there a hook to run a script before the process starts? I know there is a hook to run things after the cert is renewed, and I plan to use that to close the port again.

EDIT: I looked for an answer before posting, but I didn't look enough.
--pre-hook Command to be run before obtaining any certificates.

This appears to be exactly what I need. Now I just need to figure out how to update the saved configuration to incorporate --pre-hook and --post-hook

EDIT2: Hmmm. These commands are 'are to install the cert to nginx/apache or any other server after issue/renew a cert' which isn't where I need these hooks to run. I probably just don't know what I'm doing (I definitely don't know what I'm doing)

[neilpang]

yes, --pre-hook is used to open 80 port on your firewall.
and --post-hook is to close that port.