Using the RPKI system

The Resource Certificate

The resource certificate is linked to the organisation object in the RIPE Database of an LIR or End User.

. This is because only for as long as you are a RIPE NCC member and have a contractual relationship with the RIPE NCC can it be authoritatively stated who the holder of a certain Internet number resource is. This means the certificate has a validity of 18 months, but it is automatically renewed every 12 months.

If you obtain new resources from the RIPE NCC, they will be automatically added to your certificate. If you return resources to the RIPE NCC, a new, updated certificate is automatically issued. Any statement you have made referring to resources you no longer hold will be automatically invalidated.

In case an Internet number resource is moved or transferred (for example if an End User becomes an LIR or due to a transfer), the organisation object listed in the RIPE Database will change, therefore the certificate will change.

This means that the underlying ROAs will be removed and must be re-created.

The Hosted System

The advantage of the hosted system is that there is nothing you have to manage except making sure that your ROAs match your intended BGP routing. We provide a simple web-based user interface in which you can manage your ROAs, as well as an API. All of the cryptographic operations, such as key rollovers and publication, are handled by the system. The disadvantage is that the private key of your resource certificate resides on a server hosted by the RIPE NCC and is not retrievable from the secured system.

Running Your Own Certificate Authority

Tools and Services:
RIPE NCC Hosted Resource Certification (RPKI) Service (requires RIPE NCC Access login)
Dragon Research Labs open source implementation of RPKI tools
RPKI Management API for the hosted system
Krill by NLnet Labs

More information:
RPKI Test Environment