You can do DNS challenges for air gapped networks as long as the TXT records resolve publicly.

So then you have a signed CSR right? How would you get the certificate onto the box?