- Certificate Transparency logs leak internal domain names, therefore potentially internal infrastructure or product still in stealth mode - HTTPS challenge req

- Certificate Transparency logs leak internal domain names, therefore potentially internal infrastructure or product still in stealth mode - HTTPS challenge requires opening the network to the entire internet - DNS challenge requires API access to the DNS provider. The DNS entries are the keys to the castle (MX mainly). Some names ever operators don’t offer sensible API access (none at all, or poor scoping (single token with global admin access))