Hi @lew, you don’t need an individual IP address because of Subject Alternative Names (SAN), which let a single certificate be valid for many different domains, and likely also because of Server Name Indication (SNI), which lets a client indicate which domain name it’s trying to connect to when beginning the TLS session. Each of these has some limitations: there’s a maximum number of SAN names per certificate, SANs reveal in an obvious way exactly which sites may be hosted on the same server, and SNI isn’t supported by some old client software.
If you don’t have access to the server environment, the hosting provider would need to complete the domain validation process on your behalf. We are trying to make it practical for all hosting providers to make use of our services, so the answer for whether we can work with a given provider should in principle almost always be yes, but they may need to do some engineering work to integrate with us.