Yup, in fact it is even possible with just port 443 forwarded, via the TLS-ALPN-01 validation method supported by LetsEncrypt and Caddy. I even implemented that validation method in my own reverse proxy server I wrote.
Unfortunately, just getting that far is difficult for a lot of users...