Let's Encrypt will check domains from six remote vantage points

Let's Encrypt will check domains from six remote vantage points

15 October 2026: Let's Encrypt will validate domains from six remote network perspectives instead of four, so every certificate request triggers seven validation checks: one from its primary datacentre and six from elsewhere. The new regions go live in the staging environment on Tuesday 27 October 2026 and, if staging goes well, in production on Tuesday 10 November 2026.

Why the count is going up

The change follows the CA/Browser Forum's Baseline Requirements, section 3.2.2.9, which takes effect on 15 December 2026. From that date every publicly trusted certificate authority must corroborate domain validation from at least five remote network perspectives, and those perspectives must sit in the service regions of at least two different Regional Internet Registries. If the quorum is not met, the CA must not issue the certificate.

The point is to make validation harder to fool with a routing attack. An attacker who hijacks the route to a domain's servers, through a BGP announcement or a compromised network path, can answer a challenge sent from one place. Answering it from enough separate networks at once is much harder. Let's Encrypt says the primary server and a quorum of the remote perspectives must all receive the correct challenge response for validation to pass.

What could break

Let's Encrypt says it expects "little to no impact to users", and for most sites nothing needs to change. The cases worth checking are the ones where a site deliberately limits who can reach the challenge path:

• Geo-blocking: a web application firewall or CDN rule that blocks traffic from some countries can stop a perspective in one of the new regions from reaching /.well-known/acme-challenge/ over HTTP-01, and enough failures break the quorum.
• IP allow-lists: Let's Encrypt does not publish a fixed list of validation addresses, so firewalls that only admit known ranges to port 80 will start failing as perspectives are added.
• DNS-01 setups: DNS challenges are checked from the same perspectives, so authoritative DNS servers with regional restrictions or split-horizon views should answer consistently everywhere.

Running a renewal against the staging environment after 27 October is the cheapest test: a failure there shows up two weeks before production changes.

The other certificate dates on the calendar

This is the second Let's Encrypt change with a date attached this autumn. Our earlier item covers the move to 64-day certificates by default from 10 February 2027, which shortens renewal intervals for anyone who hard-coded them. Teams that already automate renewal through ACME clients will absorb both; those that still renew by hand, or run validation through tightly firewalled hosts, are the ones the two changes are aimed at. Let's Encrypt says updates on the rollout will be posted in the announcement thread.

Sources

• Let's Encrypt community, API Announcements: Let's Encrypt is adding two additional remote perspectives for domain validation, 15 October 2026