MPIC (Multi-Perspective Issuance Corroboration)

MPIC (Multi-Perspective Issuance Corroboration) was introduced by CA/Browser Forum Ballot SC-067. In addition to its primary check, a CA must perform domain control validation and CAA lookups from multiple remote network perspectives and proceed only when a quorum of them sees the same result. It became required on 2025-03-15 with at least 2 remote perspectives, quorum enforcement began on 2025-09-15, and the required number of perspectives rises through 2026.

Why it matters

Validation from a single location can be fooled by a localized attack, such as a BGP hijack or DNS spoofing that only affects the network near the CA's validation server. With MPIC, an attacker must fool vantage points in several networks at once. Let's Encrypt already validated from multiple perspectives before the ballot. For operators the side effect is practical: every perspective must be able to reach your challenge, so geo-blocking, firewalls that admit only certain source IPs, or DNS that answers differently by region can make HTTP-01 or DNS-01 validation fail.

Example

A site's firewall drops all traffic from outside its home country. Validation from one perspective succeeds, but perspectives in other regions time out, the quorum is not met, and the ACME client reports a timeout during connect. Opening port 80 to all sources during validation, or switching to DNS-01 with publicly reachable authoritative DNS, fixes it.

Common misconceptions

• Allowlisting the CA's IP addresses is a good firewall policy. Perspectives are spread across networks and can change; restricting source IPs is a classic cause of MPIC failures.
• MPIC only applies to HTTP-01. It applies to DNS-based validation and CAA checks too.
• MPIC protects against a compromised DNS provider. If your authoritative DNS itself is compromised, every perspective sees the same false answer.