Open MPIC
| Developer(s) | Princeton University – Center for Information Technology Policy |
|---|---|
| Initial release | February 13, 2024 |
| Written in | Various |
| Engine | |
| Platform | Cross-platform |
| Type | Certificate validation / Web security |
| License | Open source |
| Website | CITP Website |
Search Open MPIC on Amazon.
Open MPIC (Open Multi-Perspective Issuance Corroboration) is an open-source project developed by researchers at Princeton University to protect against BGP hijacking attacks during certificate issuance. It provides a scalable, API-based implementation of the Multi-Perspective Issuance Corroboration (MPIC) technique, which enhances the security of domain control validation used by Certificate Authorities (CAs).
Background
Domain control validation is a process used by CAs to verify that a requester has control over a given domain name before issuing a certificate. This process is vulnerable to BGP routing attacks, where an attacker reroutes traffic to impersonate a domain during validation. Such attacks can result in fraudulent certificates being issued.
The MPIC technique, proposed in a 2018 USENIX paper by Princeton researchers, mitigates this risk by performing validation from multiple, geographically distinct network vantage points. Because many BGP attacks are localized, validation from unaffected perspectives can detect inconsistencies and prevent certificate issuance.
Motivation
Several major CAs have implemented MPIC-like mechanisms. However, these implementations are often tied to proprietary infrastructure:
- Let's Encrypt uses MPIC in its Boulder CA but supports only ACME validations.
- Google Trust Services operates an internal MPIC system restricted to Google's environment.
- Cloudflare developed an HTTP API-based MPIC but does not yet support non-ACME methods.
Open MPIC was created to provide a flexible, cloud-agnostic implementation that can be deployed independently by any CA.
Features
- ACME and non-ACME support: Supports HTTP and DNS-based validation with flexible URL structures.
- RESTful API: Exposes MPIC functionality via secure HTTPS APIs.
- CAA compliance checking: Concurrent or on-demand retrieval of CAA records from multiple perspectives.
- Detailed logging: Complies with draft CA/B Forum MPIC logging requirements; includes perspective identifiers, validation results, and challenge metadata.
- Secure infrastructure: Uses TLS and encrypted channels for all communications; designed with best practices in mind.
- Automated deployment: Supports one-command deployment via cloud access tokens; includes configuration and monitoring scripts.
- Serverless option: Can operate entirely via serverless functions to reduce costs and complexity.
- High configurability: CA administrators can define quorum policies, network locations, and perspective counts.
- Cross-cloud compatibility: Designed to be cloud-provider agnostic to accommodate CA preferences and reduce vendor lock-in.
Adoption and Development
The project was announced on February 13, 2024, on the CITP blog.[1] The project is maintained by Princeton's Center for Information Technology Policy and published at its official site.[2]
Notably, engineers from Sectigo—a major public certificate authority—have contributed early feedback and real-world deployment insights to help shape the architecture of Open MPIC.
The project’s official repositories are available on GitHub at github.com, which includes the API specification, core Python library, and multiple deployment models. Interested contributors can engage with the maintainers through the GitHub issues pages or by contacting the team via the project email list.
See also
- Public key infrastructure
- Certificate Authority
- Domain validation
- BGP hijacking
- Let's Encrypt
- Google Trust Services
External links
References
- ↑ "Announcing the Open Multi-Perspective Issuance Corroboration Project". CITP Blog. 2024-02-13. Retrieved 2025-05-13.
- ↑ "Open Multi-Perspective Issuance Corroboration". Open MPIC. CITP, Princeton University. Retrieved 2025-05-13.
This article "Open MPIC" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:Open MPIC. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.
