Let's Encrypt Checks Your Site From Six Places

On 27 October 2026, Let's Encrypt confirmed that its staging environment now validates domains from six remote network perspectives. Let's Encrypt is a certificate authority: it checks that you control a domain, then issues the certificate browsers rely on. Staging is the test system. Production is planned for Tuesday, 10 November 2026, if staging goes well. A site that geo-blocks visitors, or allow-lists who may reach the certificate check, can fail that renewal while the pages still look normal to customers.

I can review that path with you before the live date. The Able Retainer is $799 a month for eight hours of senior production time, planned with you. Write to greg@ableadmins.com and tell me the domain.

What changed

On 15 October 2026, Let's Encrypt staff member Phil announced two new remote perspectives for domain validation. A perspective is a check from another place on the internet, alongside the check from Let's Encrypt's primary datacenter. Phil described seven validation requests: one from the primary datacenter and six from remote perspectives, where there had been four.

Phil wrote that validation succeeds only if the primary server and a quorum of remote perspectives receive the correct challenge response. A quorum means enough of the remote checks must see that response. He also wrote that more perspectives improve protection against BGP attacks. BGP is how networks announce the path to an address. Interfering with those announcements can send a validation request to the wrong place.

The announcement quotes CA/Browser Forum Baseline Requirements 3.2.2.9. The Forum sets rules for certificate authorities. Effective 15 December 2026, a certificate authority must use at least five remote network perspectives. The corroborating remote perspectives must fall within the service regions of at least two distinct Regional Internet Registries. A Regional Internet Registry allocates internet addresses for a large part of the world. If those requirements are not met, the certificate authority must not issue the certificate.

Let's Encrypt set staging to begin with the new regions on Tuesday, 27 October 2026, and production on Tuesday, 10 November 2026 if staging goes well. It said it expects little to no impact to users. On 27 October 2026 Phil posted that the staging environment is now using a total of six remote network perspectives. His announcement and the 27 October update are in the Let's Encrypt community thread.

What this means for your site

DeployBase, covering this change, lists what can make the new validation requests fail. A firewall, content delivery network, or web application firewall that geo-blocks may refuse one of the new perspectives. Geo-blocking means refusing traffic by country or region. A content delivery network stores copies of your site closer to visitors. A web application firewall filters requests before they reach your site. A source-IP allow-list answers only addresses already written down. Per-path rate limiting caps how often one folder may be requested. Split-horizon DNS shows one address to the public internet and another inside your office, so a remote check can be sent to the wrong machine. Proxying /.well-known/acme-challenge/ to an app that returns a login page, an HTTPS redirect, or a 403 means the checker does not receive the correct challenge response.

That path belongs to HTTP-01, the method that proves you control the domain by serving a small file over ordinary web traffic. DeployBase recommends exempting the path, so those requests pass through, or using DNS-01 before the 10 November production date. DNS-01 uses a record in your domain's public directory instead of a file on the site. Exempting the path means the firewall, content network, or application lets that one folder answer plainly. The DeployBase write-up walks through the same cases.

Questions to send your host

These are practical questions, in ordinary language, for whoever looks after the site. You can forward them as they are.

Does the certificate come from Let's Encrypt, using a file on the site or a DNS record?
Is there a firewall, a content delivery network, or a country block in front of the public site?
Does the server answer only a written list of internet addresses?
What does /.well-known/acme-challenge/ return to someone outside your usual countries: a file, a login page, an HTTPS redirect, or a 403?
If you have a staging certificate with Let's Encrypt, renew it there before production, since staging already uses six remote perspectives.

Ask your host to exempt that path, or to switch the renewal to DNS-01, before Tuesday, 10 November 2026. I go through this list with owners in the US and Europe who want it settled before the production date.

How Able can help

I do this work with you. The Able Retainer is $799 a month for eight hours of senior production time, planned with you. For this change, we spend that time on the renewal itself: how the certificate is requested, whether a country block or an address list covers /.well-known/acme-challenge/, and the exemption or DNS-01 change that lets the remote perspectives see the right response.

When you are ready, email greg@ableadmins.com with the domain and your host's name.

Sources

When you want those hours planned around your sites, you can look at the Able Retainer and write whenever you are ready.