SC-067v3: MPIC, domain validation from multiple networks

SC-067v3 requires every publicly trusted TLS CA to repeat its domain control and CAA checks from several remote "network perspectives", in addition to its own data center, before issuing a certificate. This is called Multi-Perspective Issuance Corroboration (MPIC); it became mandatory on 2025-03-15 and gets stricter in steps until 2026-12-15.

What changed

SC-067v3 added §3.2.2.9 to the Baseline Requirements. The CA's primary perspective validates as before; remote perspectives then repeat the HTTP, DNS or TLS-ALPN check and the CAA lookup, and must agree. Remote perspectives may not share a DNS cache with each other, and from 2026 they must sit in at least two Regional Internet Registry regions. The motivation in the ballot: attackers have used BGP hijacks to fool domain validation and obtain certificates for sites they didn't control, and localized hijacks are hard to stop with routing security alone.

Effective dates

The BR text took effect on 2024-09-06. From 2025-03-15 CAs had to run MPIC with at least 2 remote perspectives but could still issue on a mismatch; from 2025-09-15 the quorum is enforced. The minimum then rises to 3 perspectives (2026-03-15), 4 (2026-06-15) and 5 (2026-12-15). With 2–5 perspectives one non-corroboration is allowed, with 6 or more two. As of November 2026 the 4-perspective stage applies.

Who is affected

CAs had to build or buy distributed validation. Site owners notice it when their validation endpoint isn't reachable from everywhere: a firewall or geo-blocking that only allows certain countries, or DNS that answers differently by location, can now make issuance fail.

What to do

Make sure /.well-known/acme-challenge/ and your authoritative DNS answer the same way worldwide. If you restrict access by country or IP range, exempt the validation path or switch to DNS-01. See the CAA guide for the other check MPIC repeats.