Re: [Sidrops] what to do when the CRL is hosed?

[Rob Austein <[e-mail]>]

Unsurprisingly, I agree with Steve on this, particularly:

On Wed, 26 Feb 2020 12:03:33 -0500, Stephen Kent wrote:
...
> There are more cases one can analyze, but I think the basic approach
> is to stick with prior, validated CRLs and contact the CA that
> issued the questionable CRL, until the matter can be resolved.

As others have observed, there is no way the RP can know what the CA
intended when the data are inconsistent.  Furthermore, given that the
code which generates the CRLs is usually right next to the code that
generates manifests (they usually advance in lock-step), there's no
particular reason to assume consistency problems would be limited to
one or the other.

Trying to make sense out of an incoherent world is always going to be
part of the RP's job.  Falling back to older valid data has always
been part of the strategy for doing that in the RPKI, and at least the
first generation of RPKI validators all did that.  It's not perfect,
but it's better than an RP trying to guess which part of the protocol
to violate in an attempt to guess what a broken CA really meant.