Support for Lets Encrypt cert auto generation on AKS API Servers with private IP Addresses

Question

Is Cert Manager/Let's Encrypt certificate auto-generation supported on Application Gateway Ingress for AKS clusters whose API servers don’t have public IP addresses (e.g. API Server Vnet integration)? I haven’t been able to make it work. It works fine with clusters whose API servers have a public IP but not for clusters with private IPs. Even though the ingress controllers have public IP addresses, the ACME challenge (using HTTP01 validation) should work, but it looks like the challenge/response doesn't succeed and certs are not generated. I want to get a definite answer from the Azure Application Gateway Ingress team if leveraging Lets Encrypt auto-generated certs requires that the API server have a public IP address. Thanks!