It&#x27;s not about proving that you can serve HTTPS, it&#x27;s about proving that you can <i>legitimately</i> serve HTTPS.<p>I&#x27;d find HTTP(S)-based validation ok if CAs wouldn&#x27;t issue certificates with an expiration time past the expiration time of the DNS records.<p>Of course that would be fairly impractical. But then DNS-based validation exists and doesn&#x27;t have these problems.