Let's Encrypt is adding two new remote perspectives for domain validation, a change driven by the requirements of the CA/Browser Forum Baseline Requirements. Under BR 3.2.2.9, effective December 15, 2026, certificate authorities must implement Multi-Perspective Issuance Corroboration using at least five remote network perspectives. Those perspectives must fall within the service regions of at least two distinct Regional Internet Registries, and issuance must not proceed if the quorum requirements are not met.
In practice, each domain validation will now involve seven total requests: one from the primary datacenter and six from remote perspectives, up from four previously. For validation to succeed, the primary server and a quorum of the remote perspectives must receive the correct challenge response. This makes it harder for attackers to hijack validation requests, and the expanded coverage improves visibility and protection against BGP attacks.
Let's Encrypt says it expects little to no impact on users. Domain validation with the new regions will begin in staging on Tuesday, October 27, 2026, with the production rollout planned for Tuesday, November 10, 2026, assuming testing goes smoothly. Updates will be posted in the original discussion thread.
The company first introduced multi-perspective validation in an earlier blog post, which provides further background on how the system works.
Source: Hacker News · Summarized by HeadlinesBriefing