Re: [Sidrops] what to do when the CRL is hosed?

[Di Ma <[e-mail]>]

I think CRL is indispensable for the RPKI.

I am reassured of this argument especially by the point that George makes here. 

As far as I observed, CRL is issued in case of some hazard things happening such as key exposures, which we weigh much worse than expiration of CRL.

As the administrator of RP software RPSTIR, our implementation sees certs invalid even if this CRL is expired. We assume that the INRs covered by those invalid certs should be put into newly issue ones if the very INR holder would like to activate them in terms of routing. 

Di


> 2020年2月26日 08:23，George Michaelson <[e-mail]> 写道：
> 
> 
> If you cannot see a CRL which you are told should exist, to assume the
> CRL doesn't matter feels extremely unwise. I may have mistakenly
> published entirely cryptographically valid things which do not now
> inform my intent, and I have tried to repudiate, and you cannot see
> that repudiation and now interpret states of routing in ways which do
> not reflect my true intent.
> 
> -George
> 
> _______________________________________________
> Sidrops mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/sidrops
>