Dear Tim, Routing-WG, On Thu, Sep 24, 2026 at 02:08:13PM +0200, Tim Bruijnzeels wrote:
The RIPE NCC has finished implementation of the RIPE policy "Revocation of Persistently Non-functional Delegated RPKI CAs”: https://www.ripe.net/publications/docs/ripe-847/ https://www.ripe.net/community/policies/proposals/2025-02/
As required by the policy, a Delegated Certification Authority (CA) will be revoked by the RIPE NCC if it remains non-functional for more than 90 days.
We began tracking non-functional delegated CAs on 9 June, while we worked on improvements to the RPKI dashboard and implementing our notification process.
Last week, on Monday 14 September, we warned users associated with the first batch of non-functional CAs that they would soon be revoked as a result of this implementation. By this point, they had already passed the 90-day threshold. We allowed them another week to fix outstanding issues before finally revoking the 35 CAs that were still non-functional yesterday.
Cool. I can see a decrease in non-functional CAs in RPKIViews monitoring: https://sobornost.net/~job/some-nonfunctional-RPKI-CAs-revoked-RIPE-847.png
Going forward, we will actively monitor Delegated CAs. If one is found to be non-functional, then all registered users of that CA will receive a notification after 7 days, 30 days, and 60 days. In our emails, we request that the CA is either fixed, or else revoked by the operator if they no longer need it. Otherwise, the CA will be revoked after the end of the 90 day period.
The RPKI Dashboard has also now been updated to show more diagnostic information to help operators that wish to restore their CA.
Thanks, I think that is helpful. Kind regards, Job