Let's Encrypt Overview
>One of the common one is to upload a certain file at a certain address of that domain.<p>I wonder if this can be socially engineered/tricked to gain a certificate for someone else's domain. Like, I've seen at least one service (Majestic Seo) that asks you to upload a document to your domain to get certain services. Now that this (will soon) exist, any such service that someone uses can generate a cert and MITM the site.<p>Also, if they're verifying over http, couldn't <i>anyone</i> just mitm the verify connection? Well, anyone with access to any computer along the route between Let's Encrypt and whatever domain they want.