Addressability != reachability. This is how the internet used to work before people got stockholm syndrome with NAT :)

Letsencrypt doesn't require you to run a public facing web server on that domain, you can use DNS challenge validation where you prove control by putting a TXT record in your domain.