There's two ways. You can include in DNS a TXT with the validation string they give you during install, meaning you can do it so it's yours. Or you can add a sp

There's two ways. You can include in DNS a TXT with the validation string they give you during install, meaning you can do it so it's yours. Or you can add a special file in a special directory of the website behind the domain you're asking a certificate for. So it means you've got access to it so you're the owner, or a technical third party who can do that. Of course it doesn't prevent a total hack of your infrastructure but when you've come to that point, you've got bigger issues.