Hacker News Reader

Comment by b112 | Hacker News Reader

I've spent 15+ minutes searching, and the digicert (linked to in the article), and other cert providers all reference a vote on "Multi-Perspective Issuance Corroboration (MPIC)".

Everywhere I've read, one "must validate domain control using multiple independent network perspectives". EG, multiple points on the internet, for DNS validation.

Yet there is not one place I can find a very specific "this is what this means". What is a "network perspective", searching shows it means "geographical independent regions". What's a region? How big? How far apart from your existing infra qualifies? How is it calculated.

Anyone know? Because apparently none of the bodies know, or wish to tell.

View on HN

Section 3.2.2.9 of this document:

https://cabforum.org/working-groups/server/baseline-requirem...

You can also just search the document for the word "Perspective" to find most references to it.

For convenience, here are the quotes that most directly answer the above question:

"Effective December 15, 2026, the CA MUST implement Multi-Perspective Issuance Corroboration using at least five (5) remote Network Perspectives. The CA MUST ensure that [...] the remote Network Perspectives that corroborate the Primary Network Perspective fall within the service regions of at least two (2) distinct Regional Internet Registries."

"Network Perspectives are considered distinct when the straight-line distance between them is at least 500 km."

Thanks muchly.

Unless I'm completely misunderstanding things Letsencrypt has been doing this since 2020 https://letsencrypt.org/2020/02/19/multi-perspective-validat...

I.e they check from multiple network locations in case an attacker has messed with network routing in some way. This is reasonable and imposes no extra load on the domain needing the certificate all the extra work falls on the CA, and if Letsencrypt can get this right there is no major reason why "Joe's garage certs" can't do the same thing.

This is outrage porn.

The same the exact IP addresses or ASNs of existing validation origins are not public, neither will any future ones be. It makes it a bit harder to coordinate an attack against this infrastructure.

It's trivial for an attacker to learn the validation origins by triggering validations of their own servers while watching the logs. Secrecy confers no advantage here.

It means the barrier of entry to the SSL certificate market gets higher, favouring established players

Renting five servers 500km apart each, spread across at least two continents is hardly a difficult or costly requirement

I kind of get your point, but think about what low barrier of entry for becoming a CA would imply.

Also, there are loads of other requirements except this one and they are there for good reasons. It’s not easy to get your root certificate accepted by Firefox/Google/Microsoft/Apple and it shouldn’t be.

Reply on news.ycombinator.com