Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add linking sentence about TAs. #68

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Add linking sentence about TAs. #68

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d21fc21
Add linking sentence about TAs.
ximon18 Feb 22, 2023
9d03460
Add missing period.
ximon18 Feb 22, 2023
73d547d
Use italics instead of single quotes.
ximon18 Feb 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 11 additions & 9 deletions source/rpki/using-rpki-data.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,15 +20,17 @@ trust. In the case of RPKI, these are the five Regional Internet Registries.
Connecting to the Trust Anchor
------------------------------

When you want to retrieve all RPKI data, you connect to the trust anchor that
each RIR provides. The root certificate contains pointers to its children, which
contain pointers to their children, and so on. These certificates, and other
cryptographic material such as ROAs, can be published in the repository that the
RIR provides, or a repository operated by an organisation who either runs
delegated RPKI themselves, or hosts a repository as a service. As a person who
wants to fetch and validate the data, formally known as a relying party, it is
not a concern where data is published. By simply connecting to the trust anchor,
the chain of trust is followed automatically.
When you want to retrieve all RPKI data, you connect to the trust anchor
that each RIR provides. The trust anchor is an :RFC:`6487` compliant X.509
certificate used to *anchor* the *root* of a certificate hierarchy. The root
certificate contains pointers to its children, which contain pointers to their
children, and so on. These certificates, and other cryptographic material
such as ROAs, can be published in the repository that the RIR provides,
or a repository operated by an organisation who either runs delegated RPKI
themselves, or hosts a repository as a service. As a person who wants to fetch
and validate the data, formally known as a relying party, it is not a concern
where data is published. By simply connecting to the trust anchor, the chain
of trust is followed automatically.

The RIR trust anchor is found through a static trust anchor locator (TAL), which
is a very simple file that contains a URL to retrieve the trust anchor and a
Expand Down