No, this is nothing specific for Lets Encrypt, this is how PKI works. A certificate is for a domain name, not an IP address. Anyone can point a (sub)domain th

No, this is nothing specific for Lets Encrypt, this is how PKI works. A certificate is for a domain name, not an IP address. Anyone can point a (sub)domain that they own to an IP address that they do not own. And then get a valid certificate for that domain. I can point an A record to [your-ip].[my-domain] and I will be able to get a valid cert for that address. However, the address in your address bar will still point to [my-domain], not yours.