I bought a domain on Namecheap a few weeks back and now that I want to set it up, I visited my domain on the web and discovered that it had a valid cert issued and was pointing to an unknown site. The cert was issued by Let's Encrypt on Dec 1 2022.
Presumably Namecheap could validate the domain and get certificates issued without my knowledge, since the domain by default points to servers they control. Does this pose a major security issue? How can people ensure that no certificates are issued in the time between the domain getting purchased and DNS settings applied on the dashboard?