You can indeed. But for certbot to verify your domain name without the dns-01 challenge, it needs access to port 80 or 443. And you’ll need to renew your certificate every 3 months 
So it’s up to you if you want to enable port 80 only once a month or figure out a more permanent method.