Was going to suggest the same. A guy at work was trying to tell me we'd have to open ports eventually for an application behind a VPN. While he was telling me I was wrong, I added the record, and pulled certs. They should really lead with that IMHO