Obtaining the initial certificate is somewhat vulnerable to MitM if the attacker can divert the verification request to a server under its control. Some countri

Obtaining the initial certificate is somewhat vulnerable to MitM if the attacker can divert the verification request to a server under its control. Some countries (including Iran IIRC) went as far as using BGP announces to do that (which makes it very obvious). Let's Encrypt uses Multi-Perspective Validation (https://letsencrypt.org/2020/02/19/multi-perspective-validation.html https://letsencrypt.org/2020/02/19/multi-perspective-validat...) in order to protect from most interception of the DV request.