Let's Encrypt is adding two additional remote perspectives for domain validation
Points and comments are a snapshot, not live.
Let's Encrypt will add two remote perspectives for domain validation, totaling seven, to meet 2026 Baseline Requirements.
Let's Encrypt is adding two new remote perspectives for domain validation, increasing the total to seven (one primary, six remote) to comply with CA/Browser Forum Baseline Requirement 3.2.2.9, effective 2026-12-15. The requirement mandates at least five remote perspectives, with perspectives spanning at least two Regional Internet Registries. Validation succeeds only when the primary server and a quorum of remote perspectives receive the correct challenge response, improving resilience against BGP hijacking. Staging rollout begins October 27, 2026; production rollout follows November 10, 2026.
What commenters are saying
Top comment notes that despite multi-perspective validation, an August attacker hijacked Hetzner IP space (RPKI-invalid but still routable) to get a valid Let's Encrypt cert for virtualizor.com, showing that multiple perspectives all point to the same hijacked destination. Two camps emerge: one argues RPKI adoption (70%) is too low to mandate, the other that RPKI validation should be required. Commenters point out that http-01 validation is vulnerable to IP hijacking regardless of DNS diversity, and that CAA records with accounturi could mitigate. Some defend the current model as a practical trade-off, noting domain control validation never aimed to prove legal identity.