Now that TLS-SNI deprecated, how to to "authenticate" via port 443?

Help
2

Unless your hostnames are on the TLS-SNI whitelist (which will go away in a month), no.

Certbot also supports DNS validation with some DNS services.

Some ACME clients support the newer port 443 TLS-ALPN-01 challenge type.