PS : by the way autoSSL actually works, it *needs* a web access on the hostname for witch it is creating a certificate : that the way it does the (minimum) verification.
So at least at the moment that the autoSSL script runs, this web access must be someway available....
But if web access must be completely be avoided at all, it is still possible to pay for a DV-certificate, and validate it by with the third party provider via email or DNS entries.