Let's Encrypt staff confirmed at 22:02 UTC on November 10 that the production API now uses 6 remote validation locations. Each domain validation now makes 7 requests in total: 1 from the primary data center and 6 from remote locations, up from 4 remote locations before. Validation succeeds only when the primary data center and the required number of remote locations all receive the correct response. The change was announced on October 15 and went live in the staging environment on October 27. Let's Encrypt expects little to no impact on users, but a few kinds of setup are worth checking in advance.

Why more locations

Validating from several network locations at once is meant to stop an attacker from using a BGP hijack to pull validation traffic to themselves and obtain a certificate for someone else's domain. Let's Encrypt has done this since 2020, and the increase comes from tighter industry rules: section 3.2.2.9 of the CA/Browser Forum Baseline Requirements says that from December 15, 2026 a certificate authority must validate from at least 5 remote network locations, spread across the service regions of at least 2 different Regional Internet Registries, and must not issue otherwise. Other certificate authorities will therefore be making similar changes.

Setups that may now fail to renew

  • Firewall and CDN rules that block visitors by country or region. Validation requests now come from more regions, and validation fails once enough locations are blocked. Let's Encrypt does not publish the IP addresses it validates from and says they may change at any time, so an allowlist will not work; the reliable approach is to leave the path /.well-known/acme-challenge/ open to the whole world. HTTP-01 validation uses port 80 and follows redirects to port 80 or 443.
  • Authoritative DNS that only answers some regions, such as geo-based resolution or a DNS firewall with regional limits. DNS-01 validation needs the TXT record to be visible from every location, and HTTP-01 validation also resolves the domain first, so it is affected in the same way.
  • Security groups or firewalls that only let "a few known IPs" reach port 80. The reason is the same as in the first item: the validation sources are neither fixed nor published.

How to test in advance

The staging environment has used 6 remote locations since October 27, and certbot's dry-run mode talks to exactly that environment, so running sudo certbot renew --dry-run on the server once tells you whether renewal works under the new validation. If it fails, the error names the domain and the validation type that did not pass; check it against the three items above. Another reason to check now is that renewals are about to become more frequent: Let's Encrypt's default certificate lifetime drops to 64 days on February 10, 2027, as described in this report, and the 6-day short-lived certificates are covered in this one. Issuing and auto-renewing certificates is covered in our Let's Encrypt SSL tutorial; if you set country-blocking rules in Cloudflare, remember to add an exception for the validation path, and Cloudflare basics are here.