diff --git a/backend/bdd/features/pki/acme/order.feature b/backend/bdd/features/pki/acme/order.feature
index e923b17e7..aed647e47 100644
--- a/backend/bdd/features/pki/acme/order.feature
+++ b/backend/bdd/features/pki/acme/order.feature
@@ -130,8 +130,9 @@ Feature: Order
 
     Examples: Bad Identifier Vluaes
       | identifier_value |
-      | 127.0.0.1 |
-      | 192.168.123.111 |
+      | 127.0.0.1        |
+      | 192.168.123.111  |
+      | 169.254.169.254  |
       | ../../etc/passwd |
 
     Then the value response.status_code should be equal to 400
diff --git a/backend/src/ee/services/pki-acme/pki-acme-schemas.ts b/backend/src/ee/services/pki-acme/pki-acme-schemas.ts
index 4c7d6c3c1..baa686e59 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-schemas.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-schemas.ts
@@ -84,6 +84,8 @@ export const CreateAcmeAccountResponseSchema = z.object({
   orders: z.string().optional()
 });
 
+export const ValidDNSIdentifierRegex = /^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))*$/;
+
 // New Order payload schema
 export const CreateAcmeOrderBodySchema = z.object({
   identifiers: z.array(
diff --git a/backend/src/ee/services/pki-acme/pki-acme-service.ts b/backend/src/ee/services/pki-acme/pki-acme-service.ts
index d928990a6..3f634d8e8 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-service.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-service.ts
@@ -54,7 +54,8 @@ import {
   AcmeIdentifierType,
   AcmeOrderStatus,
   CreateAcmeAccountBodySchema,
-  ProtectedHeaderSchema
+  ProtectedHeaderSchema,
+  ValidDNSIdentifierRegex
 } from "./pki-acme-schemas";
 import {
   TAcmeOrderResource,
@@ -483,6 +484,21 @@ export const pkiAcmeServiceFactory = ({
     // TODO: check the identifiers and see if are they even allowed for this profile.
     //       if not, we may be able to reject it early with an unsupportedIdentifier error.
 
+    // TODO: ideally, we should return an error with subproblems if we have multiple unsupported identifiers
+    if (payload.identifiers.some((identifier) => identifier.type !== AcmeIdentifierType.DNS)) {
+      throw new AcmeUnsupportedIdentifierError({ message: "Only DNS identifiers are supported" });
+    }
+    if (
+      payload.identifiers.some(
+        (identifier) =>
+          !ValidDNSIdentifierRegex.test(identifier.value) ||
+          isPrivateIp(identifier.value) ||
+          (!getConfig().isDevelopmentMode && identifier.value.toLowerCase() === "localhost")
+      )
+    ) {
+      throw new AcmeUnsupportedIdentifierError({ message: "Invalid DNS identifier" });
+    }
+
     const order = await acmeOrderDAL.transaction(async (tx) => {
       const account = (await acmeAccountDAL.findByProjectIdAndAccountId(profileId, accountId))!;
       const createdOrder = await acmeOrderDAL.create(