Re: [certtest] Welcome to the certification test


(Disclaimer: I'm speaking as one who has been working in the inter-RIR resource certification architecture design team from the NCC.)

Wilfried Woeber, UniVie/ACOnet wrote:
Dear Tim,

thanks for this ingtroduction and preview of activities!

Disclaimer: I am not an expert in certification technology, so
please be patient :-)

After reading he proposal I am wondering how and where this is
supposed to get us "in the end", or for a production stage.

I do understand that the initial steps will be focused on providing
a web-based, "hosted" (at the NCC) set of services. However my feeling
is that web-based services are difficult to script and automate.

The interface that will be opened for you in this hosted case is really the "command and control" channel. You'll really only use it if you want to alter the behavior of the system we run for you, or if you want to instruct it to do something specific. Otherwise the "RPKI engine" is envisioned to highly automated, so it will do most of the magic on its own. Therefore it probably has little value to make this communication scriptable.

Of course, if there is sufficient need for this, then the implementation team will surely act accordingly.

So - are there any plans (already) to provide remotely usable tools
for access to, eg., the ROA repository?

The repositories themselves are going to be public (they have to be, in order to enable relying parties to fetch the contents), accessibe through rsync. There are tools already out there to do fetching/verification, but you have to realize this is a work in progress, so they are not yet complete.

My feeling is that the provision of CRL info is already pointing into
this direction as I wouldn't need access to those lists as long as all
the verifications have to be done (manually) at the hosted services
site? Correct?

CRLs (or indeed, some form of revocation information) are a must in this system, and they will be used by any verification software, be it a hosted on a CLI version. This is a part of the "relying party toolset".

Best regards,
and looking forward to test-drive all that stuff,
Wilfried (from LACNIX XI in Bahia)

PS: I presume I can find the pointer to the modified version of OpenSSL
somewhere (in the vicinity of APNC?), but could you distribute that info
here on the list (in due time), too?

RFC3779 support has been a part of the official OpenSSL package since 0.9.8e, thanks to Rob Austein (ISC). Thus you'll very probably find it in your favorite distribution. Note though that this is a very low level tool in the RPKI world.