[Sidrops] spotted in the wild: broken leaf->trust anchor validation paths because of dangling AIA URI

[Job Snijders <[e-mail]>]

Dear all,

This is just a FYI.

Recently a new kind of 'brokenness' appeared in the global RPKI: a
handful of objects have a sound 'trust anchor -> leaf' validation path,
and on the other hand a broken 'leaf -> trust anchor' validation path.
This is a recent development.

Here is one example of this particular state (from leaf -> trust anchor):
Signed Object: rsync://rpki.august.tw/repo/MK/0/326131323a646434373a383061303a3a2f34342d3438203d3e20323033363335.roa
               (SHA256:bcd3df7042cfc5c7e868e8fdc0f8b792a4483a1d69b9f44ed0fd59c5b1ed0517)

The above Signed Object's EE certificate indicates
80:E9:DC:5B:A6:7F:C3:21:67:EB:60:A8:C6:90:A2:F4:22:07:48:9F is the
Authority Key Identifier (AKI) of the authority to which this object is
subordinate.

The object's "Authority Information Access" (AIA) extension hints the
authority can be found at:
rsync://rpki.august.tw/repo/localname/6/80E9DC5BA67FC32167EB60A8C690A2F42207489F.cer

However:
    $ rsync rsync://rpki.august.tw/repo/localname/6/80E9DC5BA67FC32167EB60A8C690A2F42207489F.cer
    rsync: [sender] change_dir "/localname/6" (in repo) failed: No such file or directory (2)
    rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1839) [Receiver=3.2.5]

welp... where is the parent certificate?

(now going from trust anchor -> leaf)
Some spelunking on the rsync/rrdp server uncovers the following
certificate: rsync://rpki.august.tw/repo/HYSP/6/80E9DC5BA67FC32167EB60A8C690A2F42207489F.cer
which has AKI 80:E9:DC:5B:A6:7F:C3:21:67:EB:60:A8:C6:90:A2:F4:22:07:48:9F
and and references SIA RPKI Manifest
rsync://rpki.august.tw/repo/MK/0/80E9DC5BA67FC32167EB60A8C690A2F42207489F.mft
which in turn lists the above mentioned Signed Object
326131323a646434373a383061303a3a2f34342d3438203d3e20323033363335.roa.

I understand some people in the working group consider the AIA to merely
be a soft 'hint'; but dangling Authority Information Access (AIA) URIs
might hinder operators during troubleshooting efforts. CA engines should
take special care to avoid the above state.

Kind regards,

Job