Let's Encrypt is expanding its multi-perspective domain validation from five total checks (one primary plus four remote) to seven (one primary plus six remote). The change is driven by updated CA/Browser Forum Baseline Requirements (BR 3.2.2.9), which mandate at least five remote perspectives across at least two Regional Internet Registry service regions by December 15, 2026. Let's Encrypt is going beyond the minimum. The threat model here is BGP hijacking — where an attacker manipulates internet routing to intercept validation requests and fraudulently obtain a TLS certificate for a domain they don't control. With only one or two validation points, an attacker who can poison a single BGP route can fool the certificate authority. Each additional geographically distributed perspective makes the attacker's job combinatorially harder, requiring simultaneous route hijacks visible from multiple network vantage points. The rollout is staged conservatively. Staging environment testing begins October 27, 2026. Production deployment follows November 10, 2026, well ahead of the December 15 BR deadline. Let's Encrypt expects little to no user-facing impact — legitimate domain owners whose DNS and challenge responses resolve correctly from multiple global vantage points will see no change. This is pure infrastructure hardening. Let's Encrypt already pioneered multi-perspective validation when it first added remote perspectives, and this extends the same architecture. The Baseline Requirements are catching up to what Let's Encrypt helped prove was operationally viable at scale. The quorum model — primary plus a threshold of remote perspectives must agree — means a single failed perspective doesn't block issuance, but an attacker can't succeed by compromising just one or two routes. The broader context is the ongoing arms race between certificate authorities and BGP attackers. BGP remains fundamentally insecure — RPKI adoption is growing but far from universal. Until the routing layer itself is trustworthy, the validation layer must compensate. More perspectives are the most direct available countermeasure. For the roughly 400 million certificates Let's Encrypt manages, this change represents a meaningful uplift in issuance integrity at zero cost to certificate holders. The extractive dimension here is essentially zero — this is a nonprofit CA spending its own operational resources to make the public internet's trust infrastructure more robust.
