I was looking at the how it works[1] article but it isn't clear to me how the domain is validated.<p>Couldn't an MITM between the LetsEcnrypt service and the example.com server request a certificate, then respond to the challenge, and then use that certificate later?<p>Getting a certificate from StartSSL was similar. The only difference was that there was a human involved in the loop (a mail is sent and the user has to copy paste the contents of the email), but in essence, both the services seem vulnerable.<p>This seems to be an unsolvable bootstrapping problem, unless some sort of physical verification is done.<p>What am I missing?<p>[1]: <a href="https://letsencrypt.org/howitworks/technology/" rel="nofollow">https://letsencrypt.org/howitworks/technology/</a>