# Feature Requests **URL:** https://community.letsencrypt.org/c/feature-requests/6.md [Latest](https://community.letsencrypt.org/latest.md) · [Categories](https://community.letsencrypt.org/categories.md) · [Tags](https://community.letsencrypt.org/tags.md) --- ## [About the Feature Requests category](https://community.letsencrypt.org/t/about-the-feature-requests-category/20)
**Author:** [@josh](https://community.letsencrypt.org/u/josh)\ **Replies:** 0
This category is for discussion of feature requests for the Let's Encrypt service. --- ## [CORS support for Sycamore and Willow CTLog](https://community.letsencrypt.org/t/cors-support-for-sycamore-and-willow-ctlog/252062)
**Author:** [@JemmyLoveJenny](https://community.letsencrypt.org/u/JemmyLoveJenny)\ **Replies:** 1\ **Last updated:** [October 10, 2026, 10:59pm UTC](https://community.letsencrypt.org/t/cors-support-for-sycamore-and-willow-ctlog/252062 "2026-10-10T22:59:09Z")
Hi Let’s Encrypt Community, I recently built Merkle Lens (https://merklens.app/), a small browser-based tool to help me learn about and explore Certificate Transparency logs. While testing it, I found that I couldn’t re… --- ## [Sign Internal Enterprise CA with 3rd Party CA](https://community.letsencrypt.org/t/sign-internal-enterprise-ca-with-3rd-party-ca/251899)
**Author:** [@daniel.dulin](https://community.letsencrypt.org/u/daniel.dulin)\ **Replies:** 12\ **Last updated:** [October 6, 2026, 12:18pm UTC](https://community.letsencrypt.org/t/sign-internal-enterprise-ca-with-3rd-party-ca/251899 "2026-10-06T12:18:06Z")
I have built a Subordinate CA using Active Directory Certificate Services. It will be an internal Enterprise CA that will only sign certificates for users and computers within my Active Directory Domain. Can I use a 3rd… --- ## [Support for HTTPS records in alias mode](https://community.letsencrypt.org/t/support-for-https-records-in-alias-mode/250456)
**Author:** [@schuetzm](https://community.letsencrypt.org/u/schuetzm)\ **Replies:** 14\ **Last updated:** [August 20, 2026, 10:45am UTC](https://community.letsencrypt.org/t/support-for-https-records-in-alias-mode/250456 "2026-08-20T10:45:30Z")
Apparently, both Firefox and Chrome have finally added support for HTTPS DNS records, or are at least in the process of doing so (Safari has had support for years). I'd like to ask what needs to be done to get support f… --- ## [Revisiting dns-account-01 support](https://community.letsencrypt.org/t/revisiting-dns-account-01-support/249958)
**Author:** [@mimi89999](https://community.letsencrypt.org/u/mimi89999)\ **Replies:** 1\ **Last updated:** [July 30, 2026, 4:42pm UTC](https://community.letsencrypt.org/t/revisiting-dns-account-01-support/249958 "2026-07-30T16:42:10Z")
Hi all, apologies for opening a new topic. The earlier thread is closed, so I hope it is alright to ask again a few months on: Since February, two publicly trusted CAs now offer dns-account-01 in production: Certainl… --- ## [Entra Domain Services and Secure LDAP](https://community.letsencrypt.org/t/entra-domain-services-and-secure-ldap/249944)
**Author:** [@walkerd](https://community.letsencrypt.org/u/walkerd)\ **Replies:** 8\ **Last updated:** [July 30, 2026, 3:54pm UTC](https://community.letsencrypt.org/t/entra-domain-services-and-secure-ldap/249944 "2026-07-30T15:54:11Z")
I've read several articles and I've built out an automation using PoSH-ACME that works for normal SSL services. However, there are some limitations that are causing issues with LDAP/Domain Controller/Domain Services. S… --- ## [Request inclusion of \`Root YR\` and \`Root YE\` for Windows platforms](https://community.letsencrypt.org/t/request-inclusion-of-root-yr-and-root-ye-for-windows-platforms/249803)
**Author:** [@minafter](https://community.letsencrypt.org/u/minafter)\ **Replies:** 8\ **Last updated:** [July 28, 2026, 1:26pm UTC](https://community.letsencrypt.org/t/request-inclusion-of-root-yr-and-root-ye-for-windows-platforms/249803 "2026-07-28T13:26:54Z")
Kindly request inclusion of Root YR and Root YE for Windows platforms. This allows Microsoft Edge to display abbreviated certificate chain paths. --- ## [HTTP-01 and AWS challenge](https://community.letsencrypt.org/t/http-01-and-aws-challenge/247581)
**Author:** [@meisner](https://community.letsencrypt.org/u/meisner)\ **Replies:** 18\ **Last updated:** [May 30, 2026, 9:02am UTC](https://community.letsencrypt.org/t/http-01-and-aws-challenge/247581 "2026-05-30T09:02:26Z")
I'm not sure what IP ranges Let's Encrypt uses for it's DCV using HTTP-01, but I know they use Amazon's AWS at some point. The problem is, there are a TON of bots using AWS and other cloud service that wreck havoc on or… --- ## [Roadmap request (redux): Post-quantum cryptography](https://community.letsencrypt.org/t/roadmap-request-redux-post-quantum-cryptography/246454)
**Author:** [@codethief](https://community.letsencrypt.org/u/codethief)\ **Replies:** 11\ **Last updated:** [April 10, 2026, 8:39pm UTC](https://community.letsencrypt.org/t/roadmap-request-redux-post-quantum-cryptography/246454 "2026-04-10T20:39:45Z")
This topic was last discussed a bit more than a year ago. However, in light of recent QC research advances, experts have expressed concerns that Q-day might come much earlier than expected: 2025-12-21: Shtetl-Optimized… --- ## [DNS-PERSIST-01: Add ability to filter request IP?](https://community.letsencrypt.org/t/dns-persist-01-add-ability-to-filter-request-ip/246091)
**Author:** [@cat-armadillo](https://community.letsencrypt.org/u/cat-armadillo)\ **Replies:** 4\ **Last updated:** [March 24, 2026, 12:34pm UTC](https://community.letsencrypt.org/t/dns-persist-01-add-ability-to-filter-request-ip/246091 "2026-03-24T12:34:22Z")
I'm excited about the upcoming DNS-PERSIST-01 validation method, however I see that there is a lack of ability to filter the IP address(es) allowed to request certificates. This can be achieved with DNS-01 with DNS prov… --- ## [Proposal for making ARI standard an X.509 Extension](https://community.letsencrypt.org/t/proposal-for-making-ari-standard-an-x-509-extension/246018)
**Author:** [@xiaohuilam](https://community.letsencrypt.org/u/xiaohuilam)\ **Replies:** 5\ **Last updated:** [March 20, 2026, 12:42am UTC](https://community.letsencrypt.org/t/proposal-for-making-ari-standard-an-x-509-extension/246018 "2026-03-20T00:42:42Z")
Could Let's Encrypt (ISRG) consider drafting a RFC for ARI, as an X.509 extension embedded in SSL certificates, to facilitate the integration of renewal/replacement functionality in non‑ACME environments? --- ## [关于推出针对开源软件开发者的免费软件签名证书](https://community.letsencrypt.org/t/topic/245083)
**Author:** [@code-leitianshuo](https://community.letsencrypt.org/u/code-leitianshuo)\ **Replies:** 2\ **Last updated:** [February 3, 2026, 11:57am UTC](https://community.letsencrypt.org/t/topic/245083 "2026-02-03T11:57:06Z")
最近，我发现许多软件商店（例如微软软件商店）在上架软件时都要求这个软件有合法的软件签名证书，而商业软件签名证书对个人开发者来说是十分贵的，一年可能需要数千人民币，所以我提议ISRG组织可以推出针对于开源软件开发者的免费软件签名证书，以帮助他们将免费、开源的软件传播到更远的地方，而不必受到费用的限制，也更能够激励他们开发、优化更多的开源软件。我知道推出免费的软件签名证书可能是一件困难的事情，并且审核可能非常麻烦且不可控，但是我还是请求IS… --- ## [New auth protocol](https://community.letsencrypt.org/t/new-auth-protocol/244835)
**Author:** [@bsutton](https://community.letsencrypt.org/u/bsutton)\ **Replies:** 1\ **Last updated:** [January 24, 2026, 10:54pm UTC](https://community.letsencrypt.org/t/new-auth-protocol/244835 "2026-01-24T22:54:52Z")
The current protocols require port 80 or 443 to be open or the use of a proprietary Dns API. If you can't use these methods then you need to manually intervene to renew a certificate. I would like to propose an alterna… --- ## [Certificate Renewal Process Conflict](https://community.letsencrypt.org/t/certificate-renewal-process-conflict/244731)
**Author:** [@stamatis](https://community.letsencrypt.org/u/stamatis)\ **Replies:** 6\ **Last updated:** [January 24, 2026, 8:17pm UTC](https://community.letsencrypt.org/t/certificate-renewal-process-conflict/244731 "2026-01-24T20:17:47Z")
Background During the deployment of our infrastructure using Spacelift, we encountered a recurring issue where our stack was getting stuck during the apply phase. This was traced back to the certificate renewal process m… --- ## [Update Certificates Chains section for Gen Y Hierarchy](https://community.letsencrypt.org/t/update-certificates-chains-section-for-gen-y-hierarchy/244406)
**Author:** [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Replies:** 6\ **Last updated:** [January 12, 2026, 3:30pm UTC](https://community.letsencrypt.org/t/update-certificates-chains-section-for-gen-y-hierarchy/244406 "2026-01-12T15:30:47Z")
I saw the announcement today for Gen Y issuance using tlsserver and shortlived profiles (here). And, most of the Certificates page is updated for that. But, the Chains section at the bottom of that page does not descri… --- ## [CMC and VMC Certificates?](https://community.letsencrypt.org/t/cmc-and-vmc-certificates/244487)
**Author:** [@LarryM](https://community.letsencrypt.org/u/LarryM)\ **Replies:** 8\ **Last updated:** [January 11, 2026, 11:37pm UTC](https://community.letsencrypt.org/t/cmc-and-vmc-certificates/244487 "2026-01-11T23:37:43Z")
I guess I'm a geezer. I started building my own website in 1995 on a corporate intranet. In In 2011 I had my first two sites on the public internet, as a volunteer for two disaster response non-profits. In 2013 I was ask… --- ## [New authentication method](https://community.letsencrypt.org/t/new-authentication-method/244107)
**Author:** [@imre](https://community.letsencrypt.org/u/imre)\ **Replies:** 7\ **Last updated:** [December 25, 2025, 12:15am UTC](https://community.letsencrypt.org/t/new-authentication-method/244107 "2025-12-25T00:15:53Z")
hi, backstory: I'm having issues with dns-01 and duckdns solution: a new authentication method where you don't need to change txt records for each verification here's how it would work: preparation: you generate an … --- ## [When will Let's Encrypt's IP certificates be officially launched?](https://community.letsencrypt.org/t/when-will-lets-encrypts-ip-certificates-be-officially-launched/242941)
**Author:** [@cc2025](https://community.letsencrypt.org/u/cc2025)\ **Replies:** 99\ **Last updated:** [December 24, 2025, 3:09am UTC](https://community.letsencrypt.org/t/when-will-lets-encrypts-ip-certificates-be-officially-launched/242941 "2025-12-24T03:09:55Z")
This blog post states that IP certificates will be launched at the end of 2025. It's already November. Has the launch date been confirmed? --- ## [Certbot: deactivate authorization(s) (rfc8555#section-7.5.2)](https://community.letsencrypt.org/t/certbot-deactivate-authorization-s-rfc8555-section-7-5-2/243041)
**Author:** [@Michael.Paoli](https://community.letsencrypt.org/u/Michael.Paoli)\ **Replies:** 22\ **Last updated:** [November 21, 2025, 11:19pm UTC](https://community.letsencrypt.org/t/certbot-deactivate-authorization-s-rfc8555-section-7-5-2/243041 "2025-11-21T23:19:55Z")
certbot should really have available simple CLI means to deactivate authorization(s) E.g.: $ certbot --deactivate-authorization -d DOMAIN \[-d DOMAIN ...\] And along with that support relevant related options, e.g. to … --- ## [Https://www.isitdownrightnow.com/r12.c.lencr.org.html](https://community.letsencrypt.org/t/https-www-isitdownrightnow-com-r12-c-lencr-org-html/243111)
**Author:** [@lucaz](https://community.letsencrypt.org/u/lucaz)\ **Replies:** 2\ **Last updated:** [November 18, 2025, 3:21pm UTC](https://community.letsencrypt.org/t/https-www-isitdownrightnow-com-r12-c-lencr-org-html/243111 "2025-11-18T15:21:54Z")
--- ## [Let’s Encrypt Violates 360 Browser CA Policy](https://community.letsencrypt.org/t/let-s-encrypt-violates-360-browser-ca-policy/242557)
**Author:** [@davidzhao](https://community.letsencrypt.org/u/davidzhao)\ **Replies:** 3\ **Last updated:** [October 29, 2025, 12:07am UTC](https://community.letsencrypt.org/t/let-s-encrypt-violates-360-browser-ca-policy/242557 "2025-10-29T00:07:06Z")
360浏览器根证书计划 Says: 所有的终端用户证书必须： 包含有效的OCSP URL、AIA URL和CRL URL，以及由CA/Browser Forum Baseline Requirements所定义的适用OIDs。 In english: All subscribers certs must: Provides valid OCSP URL, AIA URL and CRL URL, and OIDs defi… --- ## [What will happened if the client can't access CRL?](https://community.letsencrypt.org/t/what-will-happened-if-the-client-cant-access-crl/242219)
**Author:** [@iseki0](https://community.letsencrypt.org/u/iseki0)\ **Replies:** 1\ **Last updated:** [October 14, 2025, 7:14pm UTC](https://community.letsencrypt.org/t/what-will-happened-if-the-client-cant-access-crl/242219 "2025-10-14T19:14:24Z")
I think the requests will get failed if the client can't access to the CRL endpoint. Please continue provide the OCSP stapling. In China or some limited network(Such as companies or schools) if the government block the… --- ## [Where is the man page?](https://community.letsencrypt.org/t/where-is-the-man-page/242180)
**Author:** [@RayKiddy](https://community.letsencrypt.org/u/RayKiddy)\ **Replies:** 10\ **Last updated:** [October 14, 2025, 4:38pm UTC](https://community.letsencrypt.org/t/where-is-the-man-page/242180 "2025-10-14T16:38:48Z")
$ man certbot No manual entry for certbot $ Really? Wow. Seems like a simple thing. fyi: Ubuntu 20.04.6 LTS --- ## [Manual hook - ensure that it waits a sufficient duration of time for DNS propagation - improve docs?](https://community.letsencrypt.org/t/manual-hook-ensure-that-it-waits-a-sufficient-duration-of-time-for-dns-propagation-improve-docs/242130)
**Author:** [@mehov](https://community.letsencrypt.org/u/mehov)\ **Replies:** 1\ **Last updated:** [October 11, 2025, 4:27pm UTC](https://community.letsencrypt.org/t/manual-hook-ensure-that-it-waits-a-sufficient-duration-of-time-for-dns-propagation-improve-docs/242130 "2025-10-11T16:27:01Z")
Hi everyone Detail: DNS problem: NXDOMAIN looking up TXT for \_acme-challenge.example.com - check that a DNS record exists for this domain Hint: The Certificate Authority failed to verify the DNS TXT records created b… --- ## [Request to Enhance Certbot to Support HTTP/2 Protocol](https://community.letsencrypt.org/t/request-to-enhance-certbot-to-support-http-2-protocol/241351)
**Author:** [@rahulverma](https://community.letsencrypt.org/u/rahulverma)\ **Replies:** 6\ **Last updated:** [September 15, 2025, 10:21am UTC](https://community.letsencrypt.org/t/request-to-enhance-certbot-to-support-http-2-protocol/241351 "2025-09-15T10:21:00Z")
Dear Let's Encrypt Team, I am part of the Cisco Expressway team, and we use certbot as our ACME client to obtain certificates signed by Let's Encrypt. During our recent feature implementation to support HTTP/2 in all HT… --- ## [DNS name for validation endpoints](https://community.letsencrypt.org/t/dns-name-for-validation-endpoints/240901)
**Author:** [@naftali](https://community.letsencrypt.org/u/naftali)\ **Replies:** 12\ **Last updated:** [September 1, 2025, 3:07am UTC](https://community.letsencrypt.org/t/dns-name-for-validation-endpoints/240901 "2025-09-01T03:07:03Z")
Hi everyone, This topic has come up many times in the forums, so I know I’m not the only one struggling with it. In many environments, it’s really hard (or even against policy) to open port 80 to the entire world just … --- ## [Secure Delegation for Service Hosting Across Domains](https://community.letsencrypt.org/t/secure-delegation-for-service-hosting-across-domains/240379)
**Author:** [@mimi89999](https://community.letsencrypt.org/u/mimi89999)\ **Replies:** 33\ **Last updated:** [August 23, 2025, 3:17pm UTC](https://community.letsencrypt.org/t/secure-delegation-for-service-hosting-across-domains/240379 "2025-08-23T15:17:29Z")
Let's imagine a service that uses the combination of localpart and domain as identifiers (e.g., user@example.com), similar to XMPP, email, and Matrix. An organization wants to use its own domain (example.com) for user id… --- ## [Has Let's Encrypt support IP certificates yet?](https://community.letsencrypt.org/t/has-lets-encrypt-support-ip-certificates-yet/240547)
**Author:** [@mahcc2025](https://community.letsencrypt.org/u/mahcc2025)\ **Replies:** 1\ **Last updated:** [August 20, 2025, 10:38am UTC](https://community.letsencrypt.org/t/has-lets-encrypt-support-ip-certificates-yet/240547 "2025-08-20T10:38:45Z")
I saw a news report saying that Let's Encrypt has supported IP certificate applications in production environments since July. Is this true? --- ## [Helpful Restrictions on Certification Profile Names](https://community.letsencrypt.org/t/helpful-restrictions-on-certification-profile-names/239974)
**Author:** [@abyss](https://community.letsencrypt.org/u/abyss)\ **Replies:** 6\ **Last updated:** [August 2, 2025, 10:00pm UTC](https://community.letsencrypt.org/t/helpful-restrictions-on-certification-profile-names/239974 "2025-08-02T22:00:39Z")
I have been reading and perhaps even implementing the active Internet-Draft "Automated Certificate Management Environment (ACME) Profiles Extension", draft-aaron-acme-profiles-01 - Automated Certificate Management Enviro… --- ## [Brand Indicates for Message Identification, CMC support](https://community.letsencrypt.org/t/brand-indicates-for-message-identification-cmc-support/239278)
**Author:** [@pketh](https://community.letsencrypt.org/u/pketh)\ **Replies:** 4\ **Last updated:** [July 19, 2025, 1:37pm UTC](https://community.letsencrypt.org/t/brand-indicates-for-message-identification-cmc-support/239278 "2025-07-19T13:37:46Z")
continuing on an old thread talking about VMC certificate support (Brand Indicators for Message Identification (BIMI) and VMC Implementation) , but in that thread, supporting VMC was rejected because it requires manual… [Next page](https://community.letsencrypt.org/c/feature-requests/6.md?page=1)