https://www.sslforfree.com/ Use this and you don't need to have any server alteration. (You authenticate via uploading a FTP file to your site, then SFF.com queries to see if you placed it there, if it exists, you get a cert and install it like you would had you bought it from Verisign.)
Sorry if this is off topic, but I have just tried sslforfree. You let it upload via FTP (or FTPS/SFTP) but the query to check if the file is there is done via HTTP. Why not just validate that the domain is mine if the FTP upload is successful? Or maybe even just redownload the file to see if contents match. I don't get it.
It's not the same, you could tell it to upload the file to a folder that is not inside your domain.
I've been thinking about passwordless authentication too. Are there any big services already using it?