No, not really. You can obtain the certificate externally and use it internally. The DNS challenge type does not require a web server exposed externally either.

No, not really. You can obtain the certificate externally and use it internally. The DNS challenge type does not require a web server exposed externally either. Sure, it's far easier not to do it. It's also far easier to have no root password.