Let's Encrypt is adding two additional remote perspectives for domain validation
- ID
- 37084
- Status
- summarized
- Published
- 19 Oct 2026, 6:53 PM
- Fetched
- 20 Oct 2026, 2:43 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://community.letsencrypt.org/t/lets-encrypt-is-adding-two-additional-remote-perspectives-for-domain-validation/252166
- Source URL
- https://hnrss.org/best
Summary
- Score
- 7.0
- Created
- 20 Oct 2026, 2:44 AM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
Let's Encrypt says it is adding two more remote perspectives to domain validation, bringing validation to seven total requests: one from its primary datacenter and six from remote vantage points. The change is driven by CA/Browser Forum Baseline Requirement 3.2.2.9, which from 2026-12-15 requires CAs to use at least five remote Network Perspectives for Multi-Perspective Issuance Corroboration, spanning at least two distinct Regional Internet Registry service regions, or refuse to issue. The stated goal is better visibility and protection against BGP attacks during validation.
Why it matters
If your certificate issuance relies on HTTP-01 challenges behind geo/IP allowlists, split-horizon DNS, or region-locked CDN/WAF rules, validation requests will now arrive from more places and a blocked perspective can fail issuance. Before the 2026-12-15 requirement bites, test that your challenge path is reachable from multiple regions rather than only your usual datacenter, and check any firewall rule that whitelists Let's Encrypt validation IPs.
Discussion angle
Who in the room runs split-horizon DNS or geo-fenced challenge endpoints, and what broke the last time a CA validated from an unexpected region?