1. BGP hijacks expose limits of multi‑perspective validation and RPKI adoption
The discussion repeatedly notes that even Let’s Encrypt’s multi‑perspective checks failed when a bogus route was RPKI‑invalid yet still accepted by most of the Internet.
“For 33 hours in late August, a rival network hijacked a block of Hetzner‑hosted infrastructure … The stolen route was RPKI‑invalid the entire time, on file, checkable by anyone. It still won on most of the internet.” – throw0101a
“70% adoption doesn't seem high enough … to be a mandatory component of validation.” – woodruffw
2. Current domain‑validation methods are unreliable or merely “security theater”
Critics argue that HTTP‑01 and even DNS‑01 challenges can be subverted, and that the existing process adds little real security beyond a band‑aid.
“http‑01 seems absolutely unreliable, any hosting provider or any government can issue fake certificates using it. What a garbage technology.” – codedokode
“I went through the standard validation many times and the entire process felt like a security theater.” – mopsi
“checking from multiple perspectives is a good idea, but still ultimately a band‑aide over the top of a flawed system. A properly engineered solution would need to ultimately come down to cryptographic proof of domain ownership.” – Ajedi32
3. Let’s Encrypt’s role in democratizing HTTPS and pushing short‑lived certificates
Many commenters credit Let’s Encrypt (and the Snowden‑era push for ubiquitous encryption) with making HTTPS cheap and automatic, while noting its shift toward very short validity periods.
“It is wild to think that enabling HTTPS used to be difficult and expensive before Let's Encrypt came along in the wake of the Snowden revelations.” – Schlagbohrer
“The most radical thing LE did was not to provide free certs, or even automated certs, but short‑lived certs.” – autoboy
“That summer, Edward Snowden came forward with chilling revelations about NSA mass surveillance, and the need for ubiquitous encryption became clearer than ever.” – onionisafruit (quoting J Alex Halderman)