300 Multiple Choices

Hi @Lansalot,

I'm glad you were able to resolve your problem.

I think the CA folks' thinking on this is that if you advertise an AAAA record, you're staring that the site should be accessible there and that this is a valid way to reach it. Remember that the CA does not know you are you, as opposed to someone impersonating you. Since the whole point of the domain control validations performed with ACME challenges is checking whether the person requesting the certificate is or is not authorized, we don't want to give them arbitrary power to contradict the DNS data or further control the validation process, particularly in the face of concerns about DNS and routing attacks against CA validation. (Otherwise, for example, an attacker who can control IPv4 routes but not IPv6 routes can falsely assert that the IPv6 routes are erroneous.)

Also, I think we want to encourage IPv6 adoption and use (although I'd admit that encountering it this way has often led people to disable it).