E-mail, DNS, and HTTP validation are all vulnerable (so, all the methods besides ACME). As for DNS validation, DNSSEC is opt-in; if one of the 350 different Cer

E-mail, DNS, and HTTP validation are all vulnerable (so, all the methods besides ACME). As for DNS validation, DNSSEC is opt-in; if one of the 350 different Certificate Authorities doesn't do mandatory stub validation, then the hijack still works on them. There's actually multiple attacks using BGP. You can either hijack the DNS or E-mail server's IP and spoof records, or you can hijack the IP of the target host and spoof an HTTP response. Or you could try all 3 to maximize your chances.