That's correct. Also, if you've got an A/AAAA record for the domain name in question, you could run an ACME client on that box that spins up a temporary web server. That's what the node-acme demo client does.

https://github.com/letsencrypt/node-acme/blob/master/lib/acm...