The ACME protocol allows this; you just need to control either the DNS records or port 80 on all of the network paths that the certificate authority (e.g. Let’s Encrypt) uses as part of the challenge response protocol.
(Is there a way to permanently opt a DNS name out of such things, I wonder? It seems unlikely that anything would survive a DNS name transfer.)
(Is there a way to permanently opt a DNS name out of such things, I wonder? It seems unlikely that anything would survive a DNS name transfer.)