do the webserver and the pi really need the same IP?
I have some hosting where I dont have SSH but wanna have LE so I try to use my Pi (which is at a completely different IP) so it should go like this (manual mode in theory)
Pi contacts LE server and requests and account for example.com
LE Server tells Pi the challenge (in this case webrrot)
Pi shows the user the challenge
User puts challenge on server
User tells Pi to tell LE that the challenge has been completed and can be verified
LE goes at example.com/challenge-url to check the challenge
LE tells the Pi whether it was successful or not.
I dont see any reason why the Pi and the LE client have to be in the same network or even need the same public IP
I dont really wanna take a site down for a while (DNS TTLs can be awfully long when you dont want it) just to make a cert and it doesnt really make sense to do so.
also I said often enough manual mode since the Pi is just the means for the purpose (like having a server without SSH or a windows webserver)