Many certificate authorities these days use the ACME protocol to automate the process of certificate issuance. This includes verifying that the applicant is the owner of the domain. And the most common way of doing this is via the HTTP-01 challenge, which challenges the applicant to serve up a given token from a server over HTTP.
But my question is, if HTTPS is what provides authentication and non-repudiation for the web, how can HTTP, a protocol without these features, be used to bootstrap HTTPS? How does the certificate authority know that the server serving up the challenge token is indeed at the IP address that it says it's at? Isn't this challenge vulnerable to a MITM attack, the very thing that HTTPS seeks to prevent?