Revocation of non-functional Delegated CAs started
Dear working group, The RIPE NCC has finished implementation of the RIPE policy "Revocation of Persistently Non-functional Delegated RPKI CAs”: https://www.ripe.net/publications/docs/ripe-847/ https://www.ripe.net/community/policies/proposals/2025-02/ As required by the policy, a Delegated Certification Authority (CA) will be revoked by the RIPE NCC if it remains non-functional for more than 90 days. We began tracking non-functional delegated CAs on 9 June, while we worked on improvements to the RPKI dashboard and implementing our notification process. Last week, on Monday 14 September, we warned users associated with the first batch of non-functional CAs that they would soon be revoked as a result of this implementation. By this point, they had already passed the 90-day threshold. We allowed them another week to fix outstanding issues before finally revoking the 35 CAs that were still non-functional yesterday. Going forward, we will actively monitor Delegated CAs. If one is found to be non-functional, then all registered users of that CA will receive a notification after 7 days, 30 days, and 60 days. In our emails, we request that the CA is either fixed, or else revoked by the operator if they no longer need it. Otherwise, the CA will be revoked after the end of the 90 day period. The RPKI Dashboard has also now been updated to show more diagnostic information to help operators that wish to restore their CA. Kind regards, Tim Bruijnzeels Principal Engineer RPKI RIPE NCC
Dear Tim, Routing-WG, On Thu, Sep 24, 2026 at 02:08:13PM +0200, Tim Bruijnzeels wrote:
The RIPE NCC has finished implementation of the RIPE policy "Revocation of Persistently Non-functional Delegated RPKI CAs”: https://www.ripe.net/publications/docs/ripe-847/ https://www.ripe.net/community/policies/proposals/2025-02/
As required by the policy, a Delegated Certification Authority (CA) will be revoked by the RIPE NCC if it remains non-functional for more than 90 days.
We began tracking non-functional delegated CAs on 9 June, while we worked on improvements to the RPKI dashboard and implementing our notification process.
Last week, on Monday 14 September, we warned users associated with the first batch of non-functional CAs that they would soon be revoked as a result of this implementation. By this point, they had already passed the 90-day threshold. We allowed them another week to fix outstanding issues before finally revoking the 35 CAs that were still non-functional yesterday.
Cool. I can see a decrease in non-functional CAs in RPKIViews monitoring: https://sobornost.net/~job/some-nonfunctional-RPKI-CAs-revoked-RIPE-847.png
Going forward, we will actively monitor Delegated CAs. If one is found to be non-functional, then all registered users of that CA will receive a notification after 7 days, 30 days, and 60 days. In our emails, we request that the CA is either fixed, or else revoked by the operator if they no longer need it. Otherwise, the CA will be revoked after the end of the 90 day period.
The RPKI Dashboard has also now been updated to show more diagnostic information to help operators that wish to restore their CA.
Thanks, I think that is helpful. Kind regards, Job
participants (2)
-
Job Snijders -
Tim Bruijnzeels