9/15/2025 Multi-Perspective Issuance Corroboration (MPIC) for all certificates. For most this is not a big change, but for a few, it requires being able to query DNS CAA records, if they exist.

8/18/2026 Certinext began interpreting RFC 8659 §6.3 -- https://datatracker.ietf.org/doc/html/rfc8659#name-delegation-to-private-names reference to SERVFAIL as preventing issuance if DNS is delegated to a DNS server that is non-public, validation will fail and the certificate will not be issued.


If you had a certificate for a domain name either in the Common Name or Subject Alternative Name with a firewalled DNS server, it could be rejected following the enforcement of the Multi-Perspective Issuance Corroboration (MPIC) that went into place on September 13, 2025. This specifically is regarding certificates requested through https://servercertificates.wisc.edu/ - and issued by Sectigo, though all certificate authorities issuing public certificates are subject to this policy, including LetsEncrypt.

This enforcement requires that Certificate Authorities (CAs) perform CAA record checks and domain validation from the public internet. If you have a domain name that currently fails these checks it no longer qualifies for publicly trusted SSL/TLS certificates.

Troubleshooting Tips

• Ensure CAA records are publicly resolvable for the domain name in question
• Test by submitting a certificate request for a domain name to https://servercertificates.wisc.edu
• Test with DNS testing tools like https://dns.google/query?name=yourdomainnamehere.wisc.edu&rr_type=CAA&ecs=
  • SERVFAIL will result in Certificate issuance failures. (Certinext started enforcing this configuration on 8/18/2026)
  • Inconsistent responses from across the world, including sometimes returning TIMEOUT and REFUSED may result in Certificate issuance failures.
  • NOERROR or NXDOMAIN are acceptable as having a CAA record is not a requirement
  • Having CAA records present that do not include the CA you’ve requested issuance from will also result in issuance failure.
    • To receive an issued certificate, ensure there are either NO CAA records present or that the CA you are requesting from does have a record present.
    • Current Root CA for Certinext: emsign.com
    • Previous Root CA: Sectigo/Incommon CAA values: Sectigo.com, trust-provider.com, usertrust.com
• Manual testing:
  • Use the linux/mac dig command to check for delegation:
    • dig soa <yourdomainnamehere.wisc.edu>
      • If the answer is any of the DNS servers listed here: https://kb.wisc.edu/117098 then your domain is hosted by the campus Infoblox instance, and is not likely to be a delegated domain
  • To test domains for access from off campus:
    • dig caa <yourdomainnamehere.wisc.edu>
    • SERVFAIL will result in Certificate issuance failures. (Certinext started enforcing this configuration on 8/18/2026)
    • Inconsistent responses from across the world, including sometimes returning TIMEOUT and REFUSED may result in Certificate issuance failures.
    • NOERROR or NXDOMAIN are acceptable as having a CAA record is not a requirement
    • Having CAA records present that do not include the CA you’ve requested issuance from will also result in issuance failure.
      • To receive an issued certificate, ensure there are either NO CAA records present or that the CA you are requesting from does have a record present.
      • Current Root CA for Certinext: emsign.com
      • Previous Root CA: Sectigo/Incommon CAA values: Sectigo.com, trust-provider.com, usertrust.com

Example domain name:

• Infoblox delegates DNS to ad.wisc.edu, which is also a private DNS server.
• Port 53 is firewalled to only allow traffic from the UW-Madison campus (+ VPN), so external DNS requests will fail
• This means that while your order will be accepted if includes either a primary name (CN) or alternative (SAN) domain name that ends with ad.wisc.edu, it will never finish to issuance.

For more information:

• Table with additional alternatives (Campus Login required): https://kb.wisc.edu/sslservercerts/internal/155314
• MPIC Enforcement
• MPIC FAQ
• CAA Record FAQ

Please reach out if you have any questions. We can provide a list of impacted subdomains that have been issued a certificate in the past year as well as associated email addresses, upon request.