As long as there isn’t a firewall blocking port 80 or 443 you could use certbot with the standalone plugin, which will temporary start a embedded webserver for just a few moments to verify the challenge.
Or if that’s not possible, you could use certbot with the manual plugin with the dns-01 challenge. But that requires (obviously) access to your DNS zone. But certbot and the dns-01 challenge isn’t a good combo for automation, so if you really need a DNS challenge you could pick one of the third party clients, such as acme.sh. I know it has many DNS API plugins.