[Sidrops] Re: BGPSec certificate validity period

["Dale W. Carder" <[e-mail]>]

Thus spake Russ Housley ([e-mail]) on Thu, Oct 16, 2025 at 04:36:33PM -0400:
> George:
> 
> How often does the NOC want to push a new certificate to the router?

It's worth pointing out there are other reasons to manage
certificates on routers, for example all of the devices on our
network have managed TLS certs for gRPC network management (gNMI)
these are headed towards 47 days or whatever the latest number is.

The infrastructure to maintain that is likely comparable to this 
effort, but I don't think we have the same issue here motivating 
short lifetimes (CRL essentially being nonfunctional).

Dale


> > On Oct 16, 2025, at 4:33 PM, George Michaelson <[e-mail]> wrote:
> > 
> > If the Web is moving to short lifetimes and the mechanism is automated, are there specific positive reasons to anchor BGPsec issuance as a long lifetime event?
> > 
> > It would help enormously (in my opinion) to have a "because .." statement tied to the assertion of a lifetime.
> > 
> > G
> > 
> > On Fri, 17 Oct 2025, 2:39 am Russ Housley, <[e-mail] <mailto:[e-mail]>> wrote:
> >> Mikhail:
> >> 
> >> > RIPE NCC is working on BGPSec support in our RPKI backend to allow
> >> > users to manage BGPSec signing requests and generate router
> >> > certificates from them.
> >> > 
> >> > One of the questions that has come up in the meantime is: what should
> >> > be the validity period of router certificates?
> >> > 
> >> > - RFC 8209 doesn't mention the validity period at all.
> >> > - RFC 8634 does mention it, but doesn't recommend a value. It just
> >> > states: “The validity period for these certificates is typically
> >> > expressed in the CA’s CPS document.” I am inclined to interpret this
> >> > as meaning that the router certificate validity period should match
> >> > that of the corresponding CA certificate.
> >> 
> >> I think you are free to specify a validity period in the CPS, but it can extend beyond the validity period of the parent CA certificate.
> >> 
> >> 
> >> > - I have also seen two different LLMs hallucinate a 35-days validity
> >> > period referring to some (might be completely made up) older draft, I
> >> > haven’t found any reference to that myself though.
> >> 
> >> The WebPKI is pushing toward 35 days.  I suspect that the LLM does not know the difference between the WebPKI and the RPKI, but I could be hallucinating too ;-)
> >> 
> >> > So, is there a consensus on router certificate validity periods?
> >> 
> >> I do not believe that this has been discussed here before, so there is no consensus.
> >> 
> >> Russ
> >> 
> >> _______________________________________________
> >> Sidrops mailing list -- [e-mail] <mailto:[e-mail]>
> >> To unsubscribe send an email to [e-mail] <mailto:[e-mail]>
> > _______________________________________________
> > Sidrops mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
> 

> _______________________________________________
> Sidrops mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]