Let's Encrypt issues certs based on challenges. One challenge method is that they make an http request to the domain. If they get the correct response back then

Let's Encrypt issues certs based on challenges. One challenge method is that they make an http request to the domain. If they get the correct response back then they will give you the cert. So what you would do is request a certificate, intercept the challenge, and answer correctly. Edit: If you did this, it would be show up in certificate transparency logs. So a very alert sysadmin could catch you in the act.