The tool doesn't care about your ownership of the domain, it cares about whether the host it's running on is trusted by the owner of the domain. The simplest wa

The tool doesn't care about your ownership of the domain, it cares about whether the host it's running on is trusted by the owner of the domain. The simplest way to verify that is for the CA to tell the tool "serve up this nonce value at this randomly-generated URL", and then to request that URL and see if it gets the right value. Depending on exactly what proof the CA wants, that will probably require some kind of tinkering with the webserver's config, or at least inspecting it to figure out how to fulfil the CA's request. Hopefully there'll be a fallback mechanism that tells the sysad what to configure, if only because not every webserver in the world is Apache or nginx.