<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Dear Job,<div class=""><br class=""></div><div class="">Please find my answers in line below:<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">Op 16 feb. 2021, om 19:22 heeft Job Snijders via routing-wg <<a href="mailto:routing-wg@ripe.net" class="">routing-wg@ripe.net</a>> het volgende geschreven:</div><br class="Apple-interchange-newline"><div class=""><div class="">Dear RIPE NCC,<br class=""><br class="">On Tue, Feb 16, 2021 at 04:56:31PM +0100, Nathalie Trenaman wrote:<br class=""><blockquote type="cite" class="">On Monday, 15 February we encountered an issue with our RPKI software.<br class="">This issue prevented us from publishing RPKI object updates from<br class="">08:07-18:06 (UTC). <br class=""><br class="">During this period, Certificate Authority activation and Route Origin<br class="">Authorization configuration updates were delayed and therefore not<br class="">visible in the RPKI repository.<br class=""></blockquote><br class="">It appears Certificate Authority revocation was also delayed.<br class=""></div></div></blockquote><div><br class=""></div><div>Indeed, all modifications, creations and deletions were delayed. </div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class=""><blockquote type="cite" class="">The updates were published after we restarted the system at 17:45<br class="">(UTC), with full recovery completed by 18:06 (UTC). Since this<br class="">non-publishing period is shorter than our default RPKI object validity<br class="">period, set to 8 hours, existing objects that are not updated were<br class="">still valid. No data was lost during this period. <br class=""></blockquote><br class="">Can the following phrase "default RPKI object validty period, set to 8<br class="">hours" please be clarified?<br class=""><br class="">For objects produced in the RIPE-hosted RPKI environment I observe the<br class="">following validity periods are commonly used:<br class=""><br class="">Object type | validity duration after issuance<br class="">-------------------+---------------------------------<br class="">CRLs | 24 hours<br class="">ROA EE certs | 18 months<br class="">Manifest eContent | 24 hours<br class="">Manifest EE certs | 7 days<br class="">CAs | 18 months<br class=""><br class="">I'm just guessing, is the '8 hour' period a reference to RIPE-751<br class="">section 2.3?<br class=""><br class=""> "A certificate will be published within eight hours of being issued (or deleted)."<br class=""></div></div></blockquote><div><br class=""></div><div>Yes, the eight hours referred to this section in the CPS but also in 4.3.1:</div><div><span style="color: rgb(51, 51, 51); font-family: "Open Sans", Helvetica, Arial, sans-serif; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">"The Production CA and the ACA, as well as hosted CAs, make all subordinate certificates and objects available for publication. While the system will make a best effort to publish these materials as soon as possible, publication should happen no later than eight hours after issuance (as described in Section 2.3.)”</span></div><div><span style="color: rgb(51, 51, 51); font-family: "Open Sans", Helvetica, Arial, sans-serif; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class=""><br class=""></span></div><div><span style="color: rgb(51, 51, 51); font-family: "Open Sans", Helvetica, Arial, sans-serif; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); text-decoration-thickness: initial;" class="">The validity periods are all longer than eight hours, and we can confirm that none of the RIPE hosted objects expired within the non-publishing time frame. </span></div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class="">The RIPE-751 CPS also states in section 4.9.8 ("Maximum latency for<br class="">CRLs"): CRLs will be published to the repository system within one hour<br class="">of their generation. <br class=""><br class="">As the outage appears to have exceeded both the 1 hour revocation window<br class="">and 8 hour object publication window, RIPE NCC was not compliant with<br class="">its own CPS.<br class=""></div></div></blockquote><div><br class=""></div><div>Correct.</div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><br class="">The multitude of RPKI service impacting events as a result from<br class="">maloperation of the RIPE NCC trust anchor are starting to give me me<br class="">cause for concern.<br class=""></div></div></blockquote><div><br class=""></div><div>I’m sorry to hear this. Transparency is key for us, this means that we report any event. In this case, we were not compliant with our CPS and this non-publishing period had operational impact. </div><div>However, not all relying party software discovered this non-publishing period, for example, rpki-client. Routinator logs these warnings. Is this something all relying party software should log? Maybe this should be discussed in the SIDROPS wg at the IETF.</div><div><br class=""></div><div>Kind regards,</div><div><br class=""></div><div>Nathalie Trenaman</div><div>Routing Security Programme Manager</div><div>RIPE NCC</div></div></div></body></html>