certbot certonly --standalone -d example.com --preferred-challenges http --http-01-port 8080

--http-01-port relocates the challenge server to port 8080 for setups where port 80 is taken by another service. The CA must still be able to reach that port, so you need a port-forward or firewall rule. Combine with --preferred-challenges http to force the HTTP method.