<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>And here is the CLI output:</p>
<p>Parent: RIPE-FRC<br>
URI: <a class="moz-txt-link-freetext" href="http://lirportal.ripe.net/certification/updown">http://lirportal.ripe.net/certification/updown</a><br>
Status: success<br>
Last contacted: 2021-07-08T21:03:07+00:00<br>
Next contact on or before: 2021-07-08T21:13:07+00:00<br>
Resource Entitlements: asn: , v4: , v6:<br>
resource class: DEFAULT<br>
issuing cert uri:
rsync://rpki.ripe.net/repository/aca/KpSo3VVK5wEHIJnHC2QHVV3d5mk.cer<br>
received certificate(s):</p>
<p>Which is interesting because it does appear that RIPE is no
longer issuing any of our entitlements. <br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 08/07/2021 13:42, Christopher
Munz-Michielin via RPKI wrote:<br>
</div>
<blockquote type="cite"
cite="mid:4548af60-1cbc-83c4-1e02-975064b6f38b@ve7alb.ca">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<p>Hi Tim,</p>
<p>Thanks for the reply. I have confirmed that the entitlements
displayed in the UI are the same as before the issue,
specifically:</p>
<p><span style="color: rgb(96, 98, 102); font-family: Lato,
sans-serif; font-size: 12px; font-style: normal;
font-variant-ligatures: normal; font-variant-caps: normal;
font-weight: 400; letter-spacing: normal; orphans: 2;
text-align: left; text-indent: 0px; text-transform: none;
white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgba(255,
255, 255, 0.953); text-decoration-style: initial;
text-decoration-color: initial; display: inline !important;
float: none;">ASN: AS59893, AS211591</span><br
data-v-7dea06be="" style="color: rgb(96, 98, 102);
font-family: Lato, sans-serif; font-size: 12px; font-style:
normal; font-variant-ligatures: normal; font-variant-caps:
normal; font-weight: 400; letter-spacing: normal; orphans: 2;
text-align: left; text-indent: 0px; text-transform: none;
white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgba(255,
255, 255, 0.953); text-decoration-style: initial;
text-decoration-color: initial;">
<span style="color: rgb(96, 98, 102); font-family: Lato,
sans-serif; font-size: 12px; font-style: normal;
font-variant-ligatures: normal; font-variant-caps: normal;
font-weight: 400; letter-spacing: normal; orphans: 2;
text-align: left; text-indent: 0px; text-transform: none;
white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgba(255,
255, 255, 0.953); text-decoration-style: initial;
text-decoration-color: initial; display: inline !important;
float: none;">IPv4: 45.148.76.0/22</span><br
data-v-7dea06be="" style="color: rgb(96, 98, 102);
font-family: Lato, sans-serif; font-size: 12px; font-style:
normal; font-variant-ligatures: normal; font-variant-caps:
normal; font-weight: 400; letter-spacing: normal; orphans: 2;
text-align: left; text-indent: 0px; text-transform: none;
white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgba(255,
255, 255, 0.953); text-decoration-style: initial;
text-decoration-color: initial;">
<span style="color: rgb(96, 98, 102); font-family: Lato,
sans-serif; font-size: 12px; font-style: normal;
font-variant-ligatures: normal; font-variant-caps: normal;
font-weight: 400; letter-spacing: normal; orphans: 2;
text-align: left; text-indent: 0px; text-transform: none;
white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-stroke-width: 0px; background-color: rgba(255,
255, 255, 0.953); text-decoration-style: initial;
text-decoration-color: initial; display: inline !important;
float: none;">IPv6: 2a0f:9400::/29</span></p>
<p><br>
I'll try and get the CLI output as well.</p>
<p>Chris<br>
</p>
<div class="moz-cite-prefix">On 08/07/2021 13:34, Tim Bruijnzeels
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:F292E4CE-533B-4F63-B4A0-3F237413A2A6@nlnetlabs.nl">
<pre class="moz-quote-pre" wrap="">Hi Christopher,
This is strange indeed. It sounds a bit like your resource entitlements under RIPE NCC may have changed.
Going with that assumption:
Krill will only allow you to create ROAs for prefixes that you hold on a certificate (or any certificate under any parent if you have multiple). However if you lose the resource on your certificate then it can no longer create the signed ROA objects. What is confusing - and I should prioritise this higher I now realise - is that the UI and API will list your previously configured "Authorisations" still. These are not actual ROAs but your intent to create ROAs if you see what I mean. If you get back the resources then the ROA objects will be re-created automatically. What is missing from the UI though is a clear indication which "Authorisation" configs would be for space you no longer hold on your certificates.
Can you check the status and resources under each parent?
You can look at the 'parents' tab in the UI, but if you have access to the CLI then please run:
krillc parents statuses --ca <your-ca>
This gives a little more info than the UI I think. You can also run this command with --format json to get even more info.
If you prefer you can share your results with <a class="moz-txt-link-abbreviated" href="mailto:rpki-team@nlnetlabs.nl" moz-do-not-send="true">rpki-team@nlnetlabs.nl</a> instead of this list - of course we would be more than happy to report back when we get further.
Kind regards,
Tim, on behalf of the NLnet Labs RPKI Team
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">On 8 Jul 2021, at 21:05, Christopher Munz-Michielin via RPKI <a class="moz-txt-link-rfc2396E" href="mailto:rpki@lists.nlnetlabs.nl" moz-do-not-send="true"><rpki@lists.nlnetlabs.nl></a> wrote:
Hi All,
Got a weird issue with Krill and publishing RIPE ROAs. Background: We have been running Krill with 1 RIPE, 2 ARIN and 1 APNIC parents for the better part of a year without issue, but yesterday we started receiving reports that all our RIPE ROAs had been dropped, indeed when I look at <a class="moz-txt-link-freetext" href="https://jdr.nlnetlabs.nl/#/search/%2Frpki-repo%2Frsync%2Frpki.ripe.net%2Frepository%2FDEFAULT%2F3JsPwPrhyzvSi50Bqvw1Y_2pUdo.cer" moz-do-not-send="true">https://jdr.nlnetlabs.nl/#/search/%2Frpki-repo%2Frsync%2Frpki.ripe.net%2Frepository%2FDEFAULT%2F3JsPwPrhyzvSi50Bqvw1Y_2pUdo.cer</a> <a class="moz-txt-link-rfc2396E" href="https://jdr.nlnetlabs.nl/#/search/%2Frpki-repo%2Frsync%2Frpki.ripe.net%2Frepository%2FDEFAULT%2F3JsPwPrhyzvSi50Bqvw1Y_2pUdo.cer" moz-do-not-send="true"><https://jdr.nlnetlabs.nl/#/search/%2Frpki-repo%2Frsync%2Frpki.ripe.net%2Frepository%2FDEFAULT%2F3JsPwPrhyzvSi50Bqvw1Y_2pUdo.cer></a> this does appear to be the case.
I have verified all the ROA's exist via the Krill API as well as in the GUI. So far I have tried restarting Krill, Deleting and re-adding some ROAs, as well as deleting the delegation from RIPE and re-creating it all to no avail. I'm at the point where I'm getting ready to blow the whole setup away and rebuild from scratch, but figured I would reach out here first to see if anyone has a suggestion to recover from this weird situation.
Version of krill is 0.8.2 on ubuntu 20.04 installed from the package manager. No other RIR's seem to be effected by this.
--
RPKI mailing list
<a class="moz-txt-link-abbreviated" href="mailto:RPKI@lists.nlnetlabs.nl" moz-do-not-send="true">RPKI@lists.nlnetlabs.nl</a>
<a class="moz-txt-link-freetext" href="https://lists.nlnetlabs.nl/mailman/listinfo/rpki" moz-do-not-send="true">https://lists.nlnetlabs.nl/mailman/listinfo/rpki</a>
</pre>
</blockquote>
</blockquote>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
</blockquote>
</body>
</html>