I simply see it as an additional (and unnecessary) attack vector.<p>If you are unable to hijack the DNS servers or poison&#x2F;spoof the cache used by the CA, then you have the luxury of a whole new (and often WAY more insecure) attack surface. Then you have a cert for that domain which can be used for other, more targeted purposes.<p>EDIT: IGNORE BELOW, I WAS ASSUMING THAT LETS ENCRYPT LETS YOU VALIDATE SUBDOMAINS FROM THE TLD, BUT THIS DOEST SEEM TO BE THE CASE FROM THE DOCS.<p>e.g.<p>1) Wifi access point uses <a href="https:&#x2F;&#x2F;login.wifiprovider.com" rel="nofollow">https:&#x2F;&#x2F;login.wifiprovider.com</a> to authenticate users. This is clamped down as tight as possible. Theres no way i&#x27;m getting in to that beastie.<p>2) Their brochure site located at <a href="http:&#x2F;&#x2F;www.wifiprovider.com" rel="nofollow">http:&#x2F;&#x2F;www.wifiprovider.com</a>. It was made by some ad agency and probably allows you to log in with test&#x2F;test or uses some crappy custom CMS that allows SQL injections or even allows you to log in with a &quot;wildcard&quot; password... (this is INSANELY common). Its just a brochure site, and its not linked to the super-secure login systems in any way.<p>3) By breaking into this crappy brochure site, I can get a cert from a valid CA for the subdomain <a href="https:&#x2F;&#x2F;login.wifiprovider.com" rel="nofollow">https:&#x2F;&#x2F;login.wifiprovider.com</a> that allows me to sit at an access point, spoofing DNS and capturing valid login details.<p>That doesn&#x27;t seem right to me.