Please see:
All validations must be publically accessible from the world wide web. Otherwise anyone could generate a publically valid certificate for any hostname. You need to be able to prove ownership.
2 Likes