Let's Encrypt is an initiative from the Electronic Frontier Foundation (EFF), Mozilla, Cisco, Akamai, IdenTrust, and researchers at the University of Michigan that aims to automatically provide every domain owner with a recognized certificate that can be used for TLS.
In order to prove that you own a domain, you need to install a file with particular (randomly generated) contents at a particular (randomly generated) URL on that domain. The Let's Encrypt server will verify this by accessing the URL, before signing the certificate.
Now, suppose I have some attack which will make the domain
awesomebank.example resolve to my server. Suppose I can also MITM some peoples' connections to
https://awesomebank.example/. TLS is intended to prevent me from seeing or altering their communications to the server without being detected.
What prevents me from using this attack on the Let's Encrypt server, and obtaining a certificate for
awesomebank.example, and then using it to MITM customers of AwesomeBank without being detected (because I have a valid certificate)? Doesn't the existence of a fully automated CA make the Internet less secure?
2023 edit: this has happened. Somebody has MITMed a server, at the server, and got a TLS certificate for that server.