Suppose I have a system, where the server requires the clients to attach their ROA certificate to prove that they have the right to that IP Prefix.

Now if the client attaches the ROA certificate ( which has an extension of .roa ) , I am able to pretty print it using rcynic.

When I print it , there are different fields for validity, IP prefix , public key, etc. N

I have come across the RPKI protocol where the ROA's are cached in the router's database and is constantly updated. But I want to know weather I can assume that If a client posseses a ROA certificate, it is valid(after confirming the fields of validity)? Or is there a way to verify that the certificate is valid.

  • you need to validate with the trust anchors – schroeder Jun 4 '15 at 21:39
  • @schroederthank you so much. If you put this as an answer. I can mark it as correct :) – user3398752 Jun 5 '15 at 1:37

One of the key factors (pardon the pun) of RPKI is the network of 'trust anchors' (think CAs) that validate the ROA certificates. You need to check with them to see if the submitted ROA is valid.

  • So one of the fields in the ROA file is the public key and there is a field for the URI which points to an object which is stored in a trusted entity. When I went to the URI, and obtained the object, and compared its public key with the public key of the ROA, they were the same. Is it a good validation? – user3398752 Jun 6 '15 at 3:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.