Let's Encrypt announced it will add two new remote perspectives for domain validation starting December 15, 2026. This change increases the total validation requests from five to seven, enhancing security by requiring validation from multiple network perspectives. The update aligns with the Baseline Requirements for certificate authorities effective on the same date, aiming to improve protection against BGP attacks, according to community.letsencrypt.org.
The new process involves one primary datacenter and six remote perspectives performing validation requests, up from the previous four remote perspectives. For a certificate to be issued, the primary server and a quorum of these remote perspectives must receive the correct challenge response. This multi-perspective issuance corroboration ensures that the remote perspectives fall within service regions of at least two distinct Regional Internet Registries, as mandated by the Baseline Requirements 3.2.2.9.
This enhancement addresses growing concerns about domain validation security, particularly the risk of attackers hijacking validation requests via BGP attacks. By increasing the number and geographic diversity of validation points, Let's Encrypt strengthens the reliability of domain control verification. The Baseline Requirements set by the CA/Browser Forum require certificate authorities to implement such multi-perspective validation to maintain trust in SSL/TLS certificates.
The updated validation system will be implemented by Let's Encrypt on December 15, 2026, when the Baseline Requirements take effect. The organization previously detailed multi-perspective domain validation in an earlier blog post on their community forum, providing further technical context for this security measure.