LetsEncrypt allows you to verify ownership of your domain using the
.well-known thing, but since the site is http before the first certificate is issued, couldn't somebody do an MITM attack to give letsencrypt the response it wants without actually owning the domain? I'm pretty sure the people at LE know what they're doing, I just want to know how it works.
To clarify, I am talking about spoofing the entire process, not just guessing the nonce used after a legitimate owner begins the process. I am talking about an attacker running
certbot and doing the entire thing.