Let's Encrypt expands domain validation to six remote perspectives ahead of new CA rules

Let's Encrypt is increasing the number of remote "perspectives" it uses to confirm control of a domain before issuing a certificate, from four to six. According to an announcement on the certificate authority's community forum dated October 15, 2026, every validation will now involve seven requests in total: one from the primary datacenter and six from remote vantage points.

What is changing

Before issuing a certificate, Let's Encrypt has to verify that the requester actually controls the domain in question. It does this by sending validation challenges from multiple network locations at once. Under the new setup, the primary datacenter's request plus a quorum of the remote perspectives must all receive the correct response to the challenge. If that threshold is not met, issuance does not proceed.

The rule behind the move

The forum post gives two reasons for the expansion. One is the CA/Browser Forum Baseline Requirements, the rulebook certificate authorities must follow for their certificates to remain trusted by browsers. Section 3.2.2.9, covering Multi-Perspective Issuance Corroboration, takes effect on December 15, 2026. It requires a certificate authority to corroborate validation from at least five remote network perspectives, with the corroborating perspectives spanning the service regions of at least two distinct Regional Internet Registries, and it prohibits issuance whenever the quorum conditions laid out in its requirements table are not satisfied.

The other reason is defense against routing attacks. Validation traffic crosses the public internet, so an attacker who can influence routing decisions, for instance by announcing someone else's address space via BGP, could try to intercept validation requests and trick a certificate authority into issuing a certificate for a domain they do not own. Spreading validation across more vantage points in more regions makes that kind of hijack substantially harder, because the attacker would need to fool a quorum of independently located perspectives at the same time.

Rollout plan

Let's Encrypt expects little to no impact on users. Domain validation using the new regions begins in the staging environment on Tuesday, October 27, 2026. If that goes smoothly, the production rollout follows on Tuesday, November 10, 2026, with further updates to be posted in the same forum thread. Readers who want more background are pointed to an earlier Let's Encrypt blog post explaining multi-perspective validation, published when the perspectives were first introduced.

Why it matters

Certificate issuance is only as trustworthy as domain validation, and domain validation is only as trustworthy as the network path it travels over. BGP route manipulation has long been discussed as a way to subvert validation: if an attacker can steer the certificate authority's traffic toward themselves, the authority may end up issuing a TLS certificate for a domain the attacker never controlled. Multi-perspective corroboration is the industry's structural answer, and from December 15, 2026 it becomes mandatory for every publicly trusted certificate authority, not just Let's Encrypt.

Because the change happens entirely on the authority's side, the millions of websites that rely on Let's Encrypt certificates gain the extra protection without changing anything themselves, no new client software and no reconfiguration. The production date lands roughly a month ahead of the compliance deadline, and it shows how a minimum standard written into the Baseline Requirements translates into a concrete, largely invisible hardening of the infrastructure the web depends on for encrypted connections.