[Sidrops] what to do when the CRL is hosed?

[Job Snijders <[e-mail]>]

Hi group,

It seems we need guidance and consensus on what to do when the CRL is
hosed in some way or shape. We have two implementation discrepancies pop
up recently:

https://github.com/NLnetLabs/routinator/issues/274
RIPE NCC's top level CRL expired this weekend
(https://www.ripe.net/support/service-announcements/rpki-infrastructure-issues) 

https://lists.nlnetlabs.nl/pipermail/rpki/2019-December/000109.html

OpenBSD's rpki-client uses the x509 certificate validation functions
that come from libressl, which doesn't have a button to turn off only CRL
timestamp verification. I was told that some nasty code would be
required to work around that, so one can argue that rolling things by
hand in X509 handling rarely is a great idea.

One could also argue that a softer landing is needed, unavailability of
the CRL should mean that only the CRL itself is not available and
proceed to validate the tree without the revocation list. I can see how
that is helpful in some circumstances.

So, what to do? Whatever it is, ideally all validators follow a similar
process.

Kind regards,

Job