You need to be able to prove ownership of a domain in order to get a certificate. CAs already require this; the "lets-encrypt" command line tool just implements

You need to be able to prove ownership of a domain in order to get a certificate. CAs already require this; the "lets-encrypt" command line tool just implements a challenge-response protocol for doing it automatically. But you could implement the same protocol yourself, as long as your platform allows you to either serve the response from a well-known path at the desired domain, or add it as a TXT record in DNS.