Let's Encrypt adds two validation perspectives: who could notice

On October 15, 2026, Let's Encrypt announced that it is adding two new remote perspectives for domain validation. In practice, before it issues a certificate, it will check your domain with seven requests instead of five. The project expects little to no impact, and for most sites that will be true. The sites that could notice are the ones that decide who may reach them by country or by IP address.

What changes, in numbers

When you ask for a certificate, Let's Encrypt has to confirm you control the domain. It does this by fetching a challenge response, and it does not trust a single vantage point to do it. According to the announcement, validation will now make seven requests in total: one from the primary datacenter and six from remote perspectives, up from four. For validation to succeed, the primary server and a quorum of the remote perspectives must all receive the correct challenge response.

The reason is security. The announcement says more perspectives make validation requests harder to hijack and improve protection against BGP attacks, where someone reroutes traffic for your IP addresses so that a single check would reach them instead of you. Checking from more networks at once makes that much harder to pull off.

Why now: a rule with a date

This is not only a choice. The CA/Browser Forum's Baseline Requirements, section 3.2.2.9, say that effective 2026-12-15 a CA must use at least five remote network perspectives, that the ones corroborating the primary must fall within the service regions of at least two distinct Regional Internet Registries, and that if the requirements are not met the CA must not issue the certificate. Let's Encrypt is moving to six remote perspectives ahead of that date.

The dates, as announced: the new regions start in staging on Tuesday, October 27th, 2026, and, assuming all goes well, in production on Tuesday, November 10th, 2026. Updates will be posted in the announcement thread.

Who could notice

The announcement does not list affected setups, so what follows is general guidance. Multi-perspective validation only works if every perspective can reach your challenge. If you block traffic by country, or allow only certain IP ranges to reach the web server, a new perspective in a region you block may fail to fetch the challenge. Enough failures and the quorum is not met, so no certificate is issued. A site with nothing filtering traffic in front of the challenge path is not in this group at all.

The usual places to look are a CDN or WAF rule that geoblocks, a firewall that only admits known IPs, and a reverse proxy that filters before /.well-known/acme-challenge/ is served. A DNS-01 challenge avoids the HTTP path, but the lookups still come from several networks, so a restrictive DNS setup deserves the same look.

The quiet danger is that renewals fail weeks later, not on the day of the change. If your certificates renew automatically, make sure a failed renewal reaches a person.

Next step: if your ACME client supports Let's Encrypt's staging environment, request a test certificate there after October 27 and confirm it succeeds through your real filtering rules. Source: Let's Encrypt community, Let's Encrypt is adding two additional remote perspectives for domain validation.