You can get a Let's Encrypt certificate by fulfilling a dns-01 challenge as long as the DNS for the domain name is publicly accessible. To my knowledge, any publicly-trusted certificate authority will only vouch for a domain name for which it can verify control.
3 Likes