Not necessarily. You can always generate self-singed certificate, yes, but trusted issuers such as Let's Encrypt often use challenges that require you to temporarily modify the DNS record - that wouldn't be possible in this case.
The HTTP-01 challenge for example can be performed on any domain pointing to a machine you control, without the need to further modify DNS records, resulting in a valid certificate accepted by most browsers.