There&#x27;s been a lot of discussion about this on the IETF ACME mailing list. Essentially, the issue is that certificates don&#x27;t nominate a specific port, so if you can get a certificate for a hostname you can impersonate any service on it. Thus, any validation method needs to represent not only a single port, but the machine as a whole.<p>443 is not really ideal for this purpose, but requiring control of it is probably the least worst option, security-wise.