GlobalSign MPIC IP Address Update & Client Authentication EKU Deprecation Notice

GlobalSign MPIC IP Address Update & Client Authentication EKU Deprecation Notice

GlobalSign has announced two important updates affecting SSL/TLS certificates. Please review the following changes carefully to ensure continued service availability.

1. MPIC IP Address Update

As part of its domain validation process, GlobalSign utilises a system known as Multi-Perspective Issuance Corroboration (MPIC), which performs domain validation and CAA record checks from multiple geographic locations worldwide.

Following a compliance rule change effective 15 March 2026, all validation requests are now required to originate from IP addresses registered under distinct Regional Internet Registries (RIRs). In response to this requirement, GlobalSign has updated the IP addresses used for MPIC validation, effective 12 March 2026:

The updated IP addresses are as follows:

Region: IP Address

eu-central-1: 51.102.168.185/32

eu-north-1: 51.21.109.29/32

ap-south-1 (replaces ap-southeast-2): 43.204.171.130/32

Action Required: If your DNS or web servers are protected by firewall rules, please ensure that the above IP addresses are allowlisted. Failure to do so may result in domain validation or CAA record check failures during certificate issuance.

2. Client Authentication EKU Removal

In alignment with Google Chrome's policy, GlobalSign will be removing the Client Authentication Extended Key Usage (EKU) from all publicly trusted TLS certificates, with a deadline of 15 March 2027.

Action Required: If your services or systems rely on the clientAuth EKU, you are strongly advised to begin planning and executing your migration ahead of this deadline to avoid any potential service disruption.

Should you have any questions or require assistance regarding these changes, please do not hesitate to reach out to our support team at poweredby@pacificinternet.com