[RAM] Renumbering impossibility: TSL/SSL certs, DNS delegation etc.

Here is something further to the discussion in the "First cut at
routing & addressing problem statement" thread on whether or not it
will ever be possible to have a completely automated method of
renumbering a network, here more arguments that it will never be
possible.

In that thread I argue that the RADIR Problem Statement should not
be written as if there was even a slight possibility that new
technologies could make today's networks reliably renumbered by some
automated means.

Even with arbitrary architectural refinements in the networks of
tomorrow, as long as we are still working with IPv4 or IPv6 as we
know them today, reliable automated renumbering is not going to be
possible.

Even if end-users didn't care about portability, many of them need
multihoming.  As far as I know, the only way to cope with SSL
certificates and IP addresses of nameservers programmed into other
nameservers is to implement multihoming with genuine portability so
the servers and the entire multihomed netork keeps operating on the
same addresss.

Not all the occurrences of actual IP addresses occur in the network
itself.

If a server as an SSL certificate, that is specific to its physical
IP address.  No amount of automation can help with that, or the cost
and time-delay of getting another certificate.

Likewise, if the network contains nameservers, the IP addresses of
those will be written into other nameservers.  This takes time and
effort to change, and could result in disruption if the actual
change of address doesn't closely match the change in the next
highest DNS level.

For a substantial network to be able to move to another ISP without
near-certain disruption and without excessive costs, I believe it
simply has to take its address space with it.  Portability is the
only solution.

As far as I know, this notion of IPv6 end-users supposedly being
happy with PA space and automated renumbering has been going on for
ten years or so.  Hadn't anyone thought of all the config files
(named, httpd, imapd, firewall etc.), SSL certs, DNS delegation etc.?

  - Robin

_______________________________________________
RAM mailing list
RAM@iab.org
https://www1.ietf.org/mailman/listinfo/ram