RPKI- Resource Public key Infrastructure
Resource public key infrastructure is a way to prevent BGP hijacking. It uses password signatures to verify that ASN is allowed to declare specific subnets.
Route initiation authorization is a key component of RPKI. ROAs contains only a few entries: ASN, subnet, and maximum length. The ROA is then encrypted, signed and publicly released. Any router can then use ROA to verify that a particular announcement is authorized by the owner of the IP space.
{"asn": "AS64496", "prefix": "192.0.2.0 ARIN 24", "maxLength": 29, "ta": "ARIN"}
Declare that ASAS64496 is authorized to announce 192.0.2.0Accord 24 and any small subnets less than / 29s. In contrast, only AS64496 is allowed to accurately declare 192.0.2.0 Universe 24 below. Small subnets within this range will not be allowed.
{"asn": "AS64496", "prefix": "192.0.2.0 ARIN 24", "maxLength": 24, "ta": "ARIN"}
Maturity provides a public service in which you can find a personal ROAs. VPS checks the RPKI status of each customer subnet every night. You can check the status here. There are several different states: valid: we can verify the existence of ROA for ASN/prefix pairs. This is the state you want.
Unknown: no ROA exists for a given prefix. This is most of the space you will see. You generally don't see any problems with this state, because there is no isp that really requires RPKI.
These states may cause your IP space to be unavailable to various parts of internet and should be corrected. It is worth noting that you may not be able to access the Cloudflare from the IP space with an invalid RPKI signature: invalid ASN: at least one ROA exists for this prefix, but none of the ASNs matches the configuration of your account. If you are using private ASN, then ROAs should list our ASN (20473).
Invalid prefix length: we found a ROA that matches this prefix / ASN, but the maximum allowed prefix length is incorrect. This usually means that you need to issue a new ROA, with the maximum prefix length set to 24 of IPv4 or 48 of IPv6. You can also issue a new ROA for smaller prefixes.
RPKI can be set through your joining. Only the owner of the IP space can manage the RPKI ROAs. If you are renting IP space, you need to contact your leased company to assist in configuring RPKI.
