As a first thought, it should be possible to.

a) With control of a domain's name servers you can set up working mail handling for a domain.

b) At least some HTTPS cert providers allow verification of domain ownership using email. eg click on a link in a mail they send to (say) postmaster@targetdomain.com

With those two in place, you can generate HTTPS certs for the domain. I'm not yet familiar with LetsEncrypt, but if they allow domain verification through email then this would even be a cost free exercise.