Suppose I run a service on example.com that relies on a SRV record to direct clients to it (in my case it's xmpp, but I think this applies to anything really). The service needs a certificate to identify itself to clients, and I want to use certbot/letsencrypt to get one. However, example.com's A record points to a web host on a different server.
Is there any way to request that letsencrypt "call me back" using the SRV record rather than the A record? If not, is there a way to control its callback URL pattern, such that I can configure the web host at the A record to proxy the callback to the host that is actually requesting the certificate?
I am aware of DNS challenges as alternative verification, but for purposes of this question, assume that I don't want to keep credentials for my DNS provider on the service host.