Indeed. However, it&#x27;s important to note that even if someone does MITM letsencrypt.org, they only see your public key and CSR. The private keys never get sent over the wire, so you don&#x27;t risk leaking your private keys. However, a MITM could issue you a fake certificate that doesn&#x27;t chain back to the Let&#x27;s Encrypt root. This risk isn&#x27;t any more than the way most CAs do it now (they email you the signed certificate).