Multi-Perspective Issuance Corroboration: What changes specifically?

For TLS certificates (SC-067)

CAs must perform Domain Control Validation and Certificate Authority Authorisation from at least two distinct remote network perspectives that are geographically at least 500 kilometres apart. The TLS Baseline Requirements have been updated to v2.0.5.

Gradual increase in remote perspectives:

• September 15, 2025: At least 2 Remote Perspectives

• March 15, 2026: At least 3 Remote Perspectives

• June 15, 2026: At least 4 Remote Perspectives

• December 15, 2026: At least 5 Remote Perspectives

For S/MIME certificates (SMC-010)

S/MIME certificates comply with the identical MPIC requirements of the TLS Baseline Requirements. Since September 2024, SwissSign has also been checking CAA entries in email certificates. The S/MIME Baseline Requirements are being updated to v1.0.8.

Action needed for certificate users

Impact: Low

SwissSign customers: No adjustments are required. MPIC is a CA-side requirement that works transparently for standard configurations.

• If you use standard network configurations: No changes required.

• If you maintain IP whitelists for validation servers: Check if access from multiple geographical regions is possible.

• If you are using geo-blocking or geographically restricted DNS resolutions: DNS records and HTTP validation endpoints must be accessible from at least two RIR regions. Risk: Global blocking outside of home region.

• If you use CAA Records: CAA lookups are now performed from multiple locations – ensure your DNS infrastructure delivers globally consistent responses.

What you should do now

• Check your firewall rules and IP whitelists – are validation requests allowed from at least two different RIR regions?

• Test your DNS resolution from different geographical locations (Europe, North America, Asia) – does it deliver consistent results?

• If you use CDN or DDoS protection: Ensure that HTTP-01 ACME validations are not blocked.

Background to the ballot: Protection against BGP hijacking

Current Status: CAs traditionally validate domain control from a single network location. Attackers can manipulate DNS responses and domain validations through localised BGP hijacks to illegitimately obtain certificates for foreign domains.

Problem/Driver: Documented attacks such as the KlaySwap incident (2022) and the Celer Bridge hack (2022) show that BGP hijacking is a real threat. In both cases, attackers obtained valid SSL/TLS certificates for foreign domains through manipulated routing, which they then used to carry out man-in-the-middle attacks on encrypted HTTPS connections. The result: Theft of millions of dollars in cryptocurrency.

Routing security mechanisms like RPKI only protect against global BGP hijacks, not against locally limited, equal-cost-specific attacks. Research from Princeton University demonstrated the feasibility of such attacks and motivated the CA/B Forum to take action.

Context: Let’s Encrypt and Google Trust Services are already using MPIC on a scale of millions of certificates and are demonstrating the technical feasibility.

Foundations for Multi-Perspective Validation

What is Multi-Perspective Issuance Corroboration?

MPIC means that CAs must perform domain validations and CAA checks from multiple, geographically and topologically different network locations.

Functioning:

• CA performs validation from their primary infrastructure

• At least two more remote perspectives (from March 2026: at least three, from June 2026 at least four, from December 2026 at least five) will repeat the validation

• Remote perspectives must be at least 500 kilometres away geographically

• Only when all perspectives agree, the certificate is issued

What is a BGP hijack?

The Border Gateway Protocol (BGP) is the routing protocol of the Internet – it determines the path that data packets take through the Internet. In a BGP hijack, an attacker falsely claims to control the best route to a particular IP address range. Other networks believe this claim and direct traffic to the attacker instead of the legitimate destination.

How BGP Hijacking Compromises Certificate Issuance:

• CA wants to validate the domain ‘bank.example’

• CA sends DNS query: ‘What is the IP of bank.example?’

• Attacker has activated BGP hijack → DNS query is redirected to the attacker

• The attacker responds with his own controlled IP address

• CA validates the domain successfully... but against the attacker’s IP

• CA issues certificate for ‘bank.example’ to the attacker

• Attacker can now perform Man-in-the-Middle attacks on HTTPS connections

Two types of BGP hijacks:

Global Hijacks:

• Affect the entire Internet

• Are relatively easy to detect (many networks notice the anomaly)

• RPKI validation can protect against this

Localised Hijacks (the more dangerous ones):

• Affect only limited geographic regions

• Very difficult to detect, as only a part of the internet is affected

• RPKI does NOT help against this

• MPIC effectively protects against this type of attack

Real examples:

• KlaySwap Incident (2022): Attackers used BGP hijacking to obtain TLS certificates for the KlaySwap crypto platform. With the fake certificates, they carried out man-in-the-middle attacks and stole cryptocurrencies.

• Celer Bridge hack (2022): Similar attack on a blockchain bridge. BGP hijacking allowed for the unauthorised issuance of certificates, followed by man-in-the-middle attacks on encrypted connections.

What are Network Perspectives?

A Network Perspective is a system or collection of network components that sends outgoing Internet traffic for domain validations and CAA checks. The position is determined by the point at which unencapsulated traffic is first handed over to the Internet infrastructure.

Important: Recursive DNS resolvers must be used – direct queries to authoritative name servers are not permitted.

What is a quorum model?

Depending on the number of remote perspectives used, MPIC allows a limited number of non-matching results:

• September 2025: 2 Remote perspectives → one must match Primary

• March 2026: 3 Remote perspectives → at least 2 must match Primary

• June 2026: 4 Remote perspectives → at least 3 must match with Primary

• December 2026: 5 Remote perspectives → at least 4 must match Primary

Concrete impact in case of misconfigured perspectives: If multiple remote perspectives see different DNS records or CAA entries than the primary perspective, the certificate issuance will be rejected. This protects against local attacks, but requires globally consistent DNS configurations.

Frequently Asked Questions (FAQ)