<div dir="ltr"><div>Hi and welcome.</div><div><br></div><div>There is a lot to learn about these systems and what is typical behavior and what is not normal.<br></div><div>Besides logs which are a chore to look at, there are some <a href="https://routinator.docs.nlnetlabs.nl/en/latest/api-endpoints.html">API Endpoints</a> that can make things easier.</div><div>For example, <code class="gmail-docutils gmail-literal gmail-notranslate"><span class="gmail-pre">/api/v1/status</span></code> which has a JSON document with a bunch of diagnostic information.</div><div><br></div><div>Also there is at least one public installation of Routinator at <a href="https://rpki-validator.ripe.net/">RIPE NCC</a> which could be hopefully considered "well run".</div><div><br></div><div>You could compare the number of invalid items seen by your installation with the one at RIPE like this:</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div>curl -s "<a href="https://rpki-validator.ripe.net/api/v1/status">https://rpki-validator.ripe.net/api/v1/status</a>" |grep -i invalid | grep -v 0,<br> "invalidROAs": 1,<br> "invalidManifests": 1,<br> "invalidManifests": 1,<br> "invalidROAs": 1,<br> "invalidManifests": 1,<br> "invalidManifests": 1,</div></blockquote><div>(You can remove the grep filters to see the whole JSON output.)<br></div><div>When I compare the same endpoint URL in my Routinator installation, I get the same suggesting this view converges.</div><div><br></div><div>Tony <br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Apr 25, 2022 at 4:02 PM gustvieira99 via RPKI <<a href="mailto:rpki@lists.nlnetlabs.nl">rpki@lists.nlnetlabs.nl</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi, how are you? First of all, I would like to thank you very much for your response and for your quick response. good, so what can i do, since it is normal to have failures in the cryptographic verification or in the repositories? Do i have to wait for both to be normalized? The routinator program is working perfectly, right? I installed the software, on the ubuntu server, following this tutorial here: <a href="https://blog.apnic.net/2019/10/28/how-to-installing-an-rpki-validator/" target="_blank">https://blog.apnic.net/2019/10/28/how-to-installing-an-rpki-validator/</a><div><br></div><div>thank u very much for your help and i hope i can solve the problem!!!!<div></div><div><br></div><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Em seg., 25 de abr. de 2022 às 06:43, Alex Band <<a href="mailto:alex@nlnetlabs.nl" target="_blank">alex@nlnetlabs.nl</a>> escreveu:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello,<br>
<br>
Please do not worry about some ROAs failing validation. We’ve described this here:<br>
<br>
<a href="https://routinator.docs.nlnetlabs.nl/en/stable/initialisation.html#verifying-initialisation" rel="noreferrer" target="_blank">https://routinator.docs.nlnetlabs.nl/en/stable/initialisation.html#verifying-initialisation</a><br>
<br>
"Because it is expected that the state of the entire RPKI is not perfect as all times, you may see several warnings about objects that are either stale or failed cryptographic verification, or repositories that are temporarily unavailable.”<br>
<br>
Your Routinator is working just fine.<br>
<br>
Kind regards,<br>
<br>
Alex<br>
<br>
> On 25 Apr 2022, at 00:13, gustvieira99 via RPKI <<a href="mailto:rpki@lists.nlnetlabs.nl" target="_blank">rpki@lists.nlnetlabs.nl</a>> wrote:<br>
> <br>
> Hi, how are u?<br>
> I cannot download the .roa files using routinator, with the list of the signed bgp prefixes. when I try to download, the following errors appear and the roas are not downloaded. the error says validation failed on some and on others it says the certificate has been revoked. <br>
> <br>
> Output from my linux terminal:<br>
> root@linux41:~# routinator -v vrps<br>
> rsync://<a href="http://rpki.afrinic.net/repository/member_repository/F3646C24/1C86B7862B5B11EC8EBEF540D8A014CE/_r9_454NpaYN1sjcZoHO9aJGKC4.mft" rel="noreferrer" target="_blank">rpki.afrinic.net/repository/member_repository/F3646C24/1C86B7862B5B11EC8EBEF540D8A014CE/_r9_454NpaYN1sjcZoHO9aJGKC4.mft</a>: No valid manifest found.<br>
> CA for rsync://<a href="http://rpki.afrinic.net/repository/member_repository/F3646C24/1C86B7862B5B11EC8EBEF540D8A014CE/" rel="noreferrer" target="_blank">rpki.afrinic.net/repository/member_repository/F3646C24/1C86B7862B5B11EC8EBEF540D8A014CE/</a> rejected, resources marked as unsafe:<br>
> <a href="http://196.13.106.0/24" rel="noreferrer" target="_blank">196.13.106.0/24</a><br>
> <a href="http://196.43.250.0/24" rel="noreferrer" target="_blank">196.43.250.0/24</a><br>
> 2001:43fd::/48<br>
> AS327811<br>
> rsync://<a href="http://rpki.afrinic.net/repository/member_repository/F368F2D0/7F4A98EA6E0511E89C0D6E4BF8AEA228/6766FC685F2011EC938150DD5A40D577.roa" rel="noreferrer" target="_blank">rpki.afrinic.net/repository/member_repository/F368F2D0/7F4A98EA6E0511E89C0D6E4BF8AEA228/6766FC685F2011EC938150DD5A40D577.roa</a>: certificate has been revoked.<br>
> rsync://<a href="http://rpki.afrinic.net/repository/member_repository/F368F2D0/7F4A98EA6E0511E89C0D6E4BF8AEA228/6766FC685F2011EC938150DD5A40D577.roa" rel="noreferrer" target="_blank">rpki.afrinic.net/repository/member_repository/F368F2D0/7F4A98EA6E0511E89C0D6E4BF8AEA228/6766FC685F2011EC938150DD5A40D577.roa</a>: validation failed.<br>
> rsync://<a href="http://rpki.afrinic.net/repository/member_repository/F368F2D0/92F86E1C6E0511E8A1B5854BF8AEA228/3F046A1A1D1E11ECB9949565D8A014CE.roa" rel="noreferrer" target="_blank">rpki.afrinic.net/repository/member_repository/F368F2D0/92F86E1C6E0511E8A1B5854BF8AEA228/3F046A1A1D1E11ECB9949565D8A014CE.roa</a>: validation failed.<br>
> <br>
> how can in proceed? how can in correct these errors and normally download the .roa files?<br>
> thank u very much for your help and i hope i can solve the problem!!!!<br>
> -- <br>
> RPKI mailing list<br>
> <a href="mailto:RPKI@lists.nlnetlabs.nl" target="_blank">RPKI@lists.nlnetlabs.nl</a><br>
> <a href="https://lists.nlnetlabs.nl/mailman/listinfo/rpki" rel="noreferrer" target="_blank">https://lists.nlnetlabs.nl/mailman/listinfo/rpki</a><br>
<br>
</blockquote></div>
-- <br>
RPKI mailing list<br>
<a href="mailto:RPKI@lists.nlnetlabs.nl" target="_blank">RPKI@lists.nlnetlabs.nl</a><br>
<a href="https://lists.nlnetlabs.nl/mailman/listinfo/rpki" rel="noreferrer" target="_blank">https://lists.nlnetlabs.nl/mailman/listinfo/rpki</a><br>
</blockquote></div>