[Sidrops] Re: BGPSec certificate validity period

[George Michaelson <[e-mail]>]

If the Web is moving to short lifetimes and the mechanism is automated, are
there specific positive reasons to anchor BGPsec issuance as a long
lifetime event?

It would help enormously (in my opinion) to have a "because .." statement
tied to the assertion of a lifetime.

G

On Fri, 17 Oct 2025, 2:39 am Russ Housley, <[e-mail]> wrote:

> Mikhail:
>
> > RIPE NCC is working on BGPSec support in our RPKI backend to allow
> > users to manage BGPSec signing requests and generate router
> > certificates from them.
> >
> > One of the questions that has come up in the meantime is: what should
> > be the validity period of router certificates?
> >
> > - RFC 8209 doesn't mention the validity period at all.
> > - RFC 8634 does mention it, but doesn't recommend a value. It just
> > states: “The validity period for these certificates is typically
> > expressed in the CA’s CPS document.” I am inclined to interpret this
> > as meaning that the router certificate validity period should match
> > that of the corresponding CA certificate.
>
> I think you are free to specify a validity period in the CPS, but it can
> extend beyond the validity period of the parent CA certificate.
>
>
> > - I have also seen two different LLMs hallucinate a 35-days validity
> > period referring to some (might be completely made up) older draft, I
> > haven’t found any reference to that myself though.
>
> The WebPKI is pushing toward 35 days.  I suspect that the LLM does not
> know the difference between the WebPKI and the RPKI, but I could be
> hallucinating too ;-)
>
> > So, is there a consensus on router certificate validity periods?
>
> I do not believe that this has been discussed here before, so there is no
> consensus.
>
> Russ
>
> _______________________________________________
> Sidrops mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>