# What Is MPIC (Multi-Perspective Issuance Corroboration)?

> MPIC is the requirement that a CA repeat domain validation and CAA checks from several network locations and issue only if enough of them agree.

Source: https://ssl.sh/glossary/mpic/
Last updated: 2026-11-10

MPIC (Multi-Perspective Issuance Corroboration) was introduced by CA/Browser Forum Ballot SC-067. In addition to its primary check, a CA must perform [domain control validation](https://ssl.sh/glossary/dcv/) and [CAA](https://ssl.sh/glossary/caa/) lookups from multiple remote network perspectives and proceed only when a quorum of them sees the same result. It became required on 2025-03-15 with at least 2 remote perspectives, quorum enforcement began on 2025-09-15, and the required number of perspectives rises through 2026.

## Why it matters
Validation from a single location can be fooled by a localized attack, such as a BGP hijack or DNS spoofing that only affects the network near the CA's validation server. With MPIC, an attacker must fool vantage points in several networks at once. Let's Encrypt already validated from multiple perspectives before the ballot. For operators the side effect is practical: every perspective must be able to reach your challenge, so geo-blocking, firewalls that admit only certain source IPs, or DNS that answers differently by region can make [HTTP-01](https://ssl.sh/glossary/http-01/) or DNS-01 validation fail.

## Example
A site's firewall drops all traffic from outside its home country. Validation from one perspective succeeds, but perspectives in other regions time out, the quorum is not met, and the ACME client reports a timeout during connect. Opening port 80 to all sources during validation, or switching to DNS-01 with publicly reachable authoritative DNS, fixes it.

## Common misconceptions
- **Allowlisting the CA's IP addresses is a good firewall policy.** Perspectives are spread across networks and can change; restricting source IPs is a classic cause of MPIC failures.
- **MPIC only applies to HTTP-01.** It applies to DNS-based validation and CAA checks too.
- **MPIC protects against a compromised DNS provider.** If your authoritative DNS itself is compromised, every perspective sees the same false answer.

## Related terms

- [DCV](https://ssl.sh/zh/glossary/dcv/): DCV 即域名控制权验证，是 CA 在签发证书前确认申请者确实控制证书中每一个域名的检查。
- [CAA 记录](https://ssl.sh/zh/glossary/caa/): CAA 记录是一种 DNS 记录，用来声明哪些证书颁发机构可以为该域名签发证书，所有公共 CA 签发前都必须检查。
- [Baseline Requirements](https://ssl.sh/zh/glossary/baseline-requirements/): Baseline Requirements 是 CA/B 论坛制定的基线要求，规定公开信任的 CA 在验证、签发和吊销 TLS 服务器证书时必须遵守的规则。
- [HTTP-01](https://ssl.sh/zh/glossary/http-01/): HTTP-01 是一种 ACME 验证方式，客户端通过 80 端口以普通 HTTP 提供 CA 指定的令牌内容来证明域名控制权。
- [DNS-01](https://ssl.sh/zh/glossary/dns-01/): DNS-01 是一种 ACME 验证方式，客户端在 _acme-challenge 子域名下发布由 CA 质询计算出的 TXT 记录来证明域名控制权。
- [ACME](https://ssl.sh/zh/glossary/acme/): ACME 是 IETF 标准协议（RFC 8555），让软件自动向 CA 证明域名控制权，并自动申请、续期和吊销证书。
- [Let's Encrypt](https://ssl.sh/zh/glossary/let-s-encrypt/): Let's Encrypt 是由非营利组织 ISRG 运营的免费、自动化证书颁发机构，通过 ACME 协议签发域名验证型 TLS 证书。