[garthk]

Strikes me you could also go through the process using letsencrypt in a container (eg Docker on Linux) and extract the results.

[javajosh]

This is a good idea, but the docker daemon runs as root so it's at least theoretically possible to break out of the container and start messing with the host, as root.