Digital certificate issuing man-in-the-middle attack
Yes, that man in the middle attack is possible. The problem is that there is no direct way of providing initial trust to the CA. As long as that is not possible - traveling to the CA is rather expensive - there can be no complete trust.

The validation relies on the DNS and the fact that servers generally are on relatively secure connections. I presume that the CA itself doesn't run on public WiFi either. The challenge response protocol makes sure that you have control over the domain. It also makes sure that the challenge (nonce) cannot be copied without having the private key. But in the end it is protection so that nobody can initiate the connection with the CA 

And that's what this protocol really does; it makes sure that somebody else doesn't request a certificate in your name. The amount of protection against man-in-the-middle is very limited. If the server or admin PC is hacked then an attacker will of course have little problem performing the steps himself.

Don't do these steps from an insecure PC or over an insecure connection and make sure that your server and server connection are secure as well. Otherwise the chances of MiTM are heightened. Note that this will still take an active attack, and I presume you checked that the connection to the CA is performed over TLS (right?).