What Let's Encrypt's two new validation points mean

Let’s Encrypt will soon check that you control a domain from six remote network locations instead of four, plus its main datacenter. It announced this in a community forum post, Let’s Encrypt is adding two additional remote perspectives for domain validation. The reason is one specific rule. From December 15, 2026, the industry’s Baseline Requirements say every public certificate authority must check from at least five remote vantage points, spread across at least two Regional Internet Registries. If that check fails, the certificate must not be issued.

The background you need

A certificate authority (CA) is an organization your browser trusts to vouch for websites. When you see the padlock for a site, a CA has signed a certificate that says this key belongs to this domain. Let’s Encrypt is a free, automated CA used by a very large number of websites.

Before a CA signs anything, it must confirm that the person asking actually controls the domain. This step is called domain validation. Let’s Encrypt does it through ACME, the protocol that tools like Certbot use to request certificates automatically. The CA hands your client a challenge, which is a random token. Your server then proves control in one of two common ways. It can serve the token at a specific URL on your site, which is the HTTP-01 method. Or it can publish the token in a DNS record, which is the DNS-01 method. The CA then reaches out over the internet and checks that the token is really there.

That check has a weak spot, and it is called BGP. The Border Gateway Protocol is how the large networks that make up the internet tell each other which IP addresses they can reach. It largely runs on trust. An attacker who controls or compromises a network can announce, falsely, that they are the best route to your server’s addresses. This is a BGP hijack. If the CA’s validation request follows that false route, it lands on the attacker’s machine. The attacker serves the token, passes the check, and gets a valid certificate for your domain.

The defense is to check from more than one place. This is multi-perspective issuance corroboration. Each place the CA checks from is a network perspective. A hijack usually only fools part of the internet, because a false route spreads to some networks and not others. If several perspectives sitting in different networks all have to see the same correct answer, the attacker has to fool all of them at once. That is much harder.

Think of a bank confirming your home address. If it sends one courier, someone who redirects that courier can fake the answer. If it sends couriers from several cities who take different roads, all of them have to be fooled. The analogy breaks in one important way. On the internet, distance on a map does not matter. What counts is whether the perspectives use different network paths. Two servers on different continents can still share the same upstream route.

Regional Internet Registries (RIRs) are the five organizations that hand out IP addresses for different parts of the world: ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC. Requiring perspectives in at least two RIR regions is a rough way to force network diversity.

The Baseline Requirements (BRs) are the rulebook that browsers and CAs agree on through the CA/Browser Forum. A CA that breaks them risks losing browser trust.

What actually changed

Some of this is not new. Let’s Encrypt already used remote perspectives. It refers to an earlier blog post written when it first added them. Before this change it used four remote perspectives alongside its primary datacenter, according to the post.

Here is what is new:

• Two more remote perspectives. Each validation will now send seven requests: one from the primary datacenter and six from remote perspectives, according to Let’s Encrypt.
• A hard deadline behind it. The post quotes BR section 3.2.2.9, which takes effect 2026-12-15. It requires at least five remote perspectives. The perspectives that back up the primary one must fall within at least two distinct RIR service regions. The rule ends bluntly: if the requirements are not met, “the CA MUST NOT proceed with issuance of the Certificate.”
• A quorum rule. Validation succeeds only if the primary server and a quorum of the remote perspectives get the correct challenge response. A quorum means enough of them, not necessarily all. The exact numbers come from a Quorum Requirements Table in the BRs. The post refers to that table but does not reproduce it.
• A schedule. Let’s Encrypt plans to start using the new regions in its staging environment on Tuesday, October 27, 2026. If that goes well, production follows on Tuesday, November 10, 2026.

Notice the arithmetic. Four remote perspectives would fall below the new floor of five. Let’s Encrypt is going to six, which puts it one above the minimum.

What it means for you

The five-perspective floor is the detail that matters most. It is a rule, not a choice. It applies to every publicly trusted CA, not just Let’s Encrypt. And the penalty for missing the quorum is no certificate at all. So the question for you is simple: can six remote networks reach your validation endpoint and get the right answer?

For most people the answer is yes, and nothing changes. Let’s Encrypt says: “We expect little to no impact to users.” Your ACME client does not need an update. The extra checks happen on the CA’s side.

You should look more closely if any of these apply to you:

• Geo-blocking. If your firewall, CDN or web application firewall drops traffic from certain countries, a new perspective might sit in a blocked region. If too many perspectives fail, validation fails.
• IP allowlists. If you only let validation traffic in from specific addresses, new perspectives will arrive from addresses you have not seen before.
• DNS-01 validation. In this case the perspectives query your authoritative DNS servers. Any regional filtering on those servers matters in the same way.
• Log monitoring. Expect more validation hits per certificate request than before. This is normal, not an attack.

The practical move is to test against staging after October 27. Most ACME clients have a staging or test option for this. Then follow the forum thread, where Let’s Encrypt says it will post updates.

What we don’t know yet

• Where the new perspectives are. The post does not name the new regions or networks, so you cannot check them against your firewall rules in advance.
• How many failures are tolerated. The post says a quorum is needed but gives no number. It points to the BR table without quoting it.
• Which RIR regions are covered. The rule requires at least two. The post does not say which regions Let’s Encrypt’s six perspectives fall in.
• Whether the schedule holds. Production on November 10 depends on staging going well, in the post’s own wording.
• How other CAs will comply. The rule binds them too, but this post covers only Let’s Encrypt.