Let's Encrypt, a certificate authority (CA) providing free SSL/TLS certificates, is expanding its multi-perspective domain validation process. Starting in late 2026, the organization will increase the number of remote network perspectives used to verify domain ownership. This move is driven by the need to comply with updated Baseline Requirements, which mandate that CAs implement multi-perspective issuance corroboration using at least five remote network perspectives.
The image serves as a primary visual for the announcement regarding the expansion of remote network perspectives for domain validation.
Multi-perspective validation is a security mechanism designed to prevent attackers from hijacking a domain's certificate by manipulating internet routing. In a standard validation, a CA might check a domain from a single location. However, an attacker could use Border Gateway Protocol (BGP) hijacking to redirect traffic from that specific location to a malicious server. By using multiple 'perspectives'—requests originating from different physical locations and traveling via different network routes—the CA ensures that a quorum of these requests receives the correct challenge response. If an attacker hijacks a route for one perspective, the other perspectives will still reach the legitimate server, causing the validation to fail and preventing the issuance of a fraudulent certificate.
The updated process will involve a total of seven validation requests: one from a primary datacenter and six from remote perspectives (an increase from the previous four). To satisfy the new requirements, these remote perspectives must fall within the service regions of at least two distinct Regional Internet Registries (RIRs). Let's Encrypt plans to begin staging these new regions on October 27, 2026, with a production rollout scheduled for November 10, 2026. While the CA expects little to no impact on the end-user experience, the change is a technical necessity to improve visibility and protection against sophisticated network-level attacks. Although multi-perspective validation significantly raises the bar for attackers, it is not an absolute guarantee; historical incidents have shown that sophisticated BGP hijacks can still occasionally succeed if they affect a large enough portion of the internet's routing table simultaneously. Evidence of this ongoing challenge highlights why increasing the diversity of network vantage points remains a critical defense strategy for the CA.