<div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr">On Fri, Jan 11, 2019 at 4:13 PM Mark Kosters <<a href="mailto:markk@arin.net">markk@arin.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-8390560013737014092WordSection1">
<p class="MsoNormal">Hi David et. al.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">This is good input. The code was written to match the lifetime of the resource cert. We can certainly lower the default down. Is 3 years the consensus?
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks,<u></u><u></u></p>
<p class="MsoNormal">Mark<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12pt;color:black">From: </span></b><span style="font-size:12pt;color:black">arin-tech-discuss <<a href="mailto:arin-tech-discuss-bounces@arin.net" target="_blank">arin-tech-discuss-bounces@arin.net</a>> on behalf of David Farmer <<a href="mailto:farmer@umn.edu" target="_blank">farmer@umn.edu</a>><br>
<b>Date: </b>Friday, January 11, 2019 at 12:10 PM<br>
<b>To: </b>Christopher Morrow <<a href="mailto:morrowc.lists@gmail.com" target="_blank">morrowc.lists@gmail.com</a>><br>
<b>Cc: </b>"<a href="mailto:arin-tech-discuss@arin.net" target="_blank">arin-tech-discuss@arin.net</a>" <<a href="mailto:arin-tech-discuss@arin.net" target="_blank">arin-tech-discuss@arin.net</a>><br>
<b>Subject: </b>Re: [arin-tech-discuss] RPKI How long to set a ROA certificate<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">On Fri, Jan 11, 2019 at 1:13 AM Christopher Morrow <<a href="mailto:morrowc.lists@gmail.com" target="_blank">morrowc.lists@gmail.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">On Thu, Jan 10, 2019 at 10:29 PM Delacruz, Anthony B <<a href="mailto:Anthony.DeLaCruz@centurylink.com" target="_blank">Anthony.DeLaCruz@centurylink.com</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal">The default using ARIN systems looks to be 10 years. That just feels like too long given how other certificates I interact with expire. What is everyone else
<u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">that seems very long.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">I expect it might make sense to think about how long do you expect to need the ROA (for example)? and how often will your automation be able to update all objects which need to be updated? One other thing to keep in mind is how long do
you think a 'lost' object to be usable? <u></u><u></u></p>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">I agree that is long, and probably too long for the default, but it's not insanely long, for much of the Internet prefixes don't change very much once they are advertised and typically the prefixes allocated or assigned are the ones advertised.
The prefixes intentional advertised by our network have been stable for several decades, yes we have added new prefixes, but in the last thirty years, only one of our prefixes has had a more specific added to our list of intentionally advertised prefixes once
initially advertised. The nature and longevity (more than 150 year) of our institution lends itself to an abnormally high level of stability, nevertheless for much of the Internet stability in scale of several years is the norm.<u></u><u></u></p>
</div>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal">tending to do? We’re just putting our toe in the water for this so using the hosted to accommodate a few customers as we research and test doing delegated which probably would be
2 or so years out. Would I run into trouble if it’s too long then switch to us running on our servers? I wouldn’t think so just expire it and issue new ones right? Any tips on running hosted for a while with intent to switch to delegated?<u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">seems correct to me, there may be more wonkery required than at first blush seems right, but :)<u></u><u></u></p>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal">I think somewhere between 2 to 5 years is reasonable and going to be common, probably starting out closer to 2 years and over time moving closer to 5 years as everyone gains experience. But if you are just dipping your toes in the water
1 or 2 years seems perfectly appropriate.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I'd like to see ARIN change the default to 3 years, 10 year is way too long for the default, 10 years might be a reasonable maximum though. I'm suggesting 3 years to help encourage people to not use too short of time, but also these things
need to be regularly evaluated and update too, 3 years seems a reasonable balance of the issues, at least without additional knowledge of other circumstances involved. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> </p></div></div></div></div></div></div></div></div></blockquote><div><br></div><div>Maybe the question to ask is: "What is this cert doing, what happens if you lose control of the key material for it?"</div><div>That should guide how long a certificate could be outside of your control... and thus the length of validity of the cert?</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div class="gmail-m_-8390560013737014092WordSection1"><div><div><div><div><div><div><p class="MsoNormal"><u></u><u></u></p>
</div>
</div>
</div>
<p class="MsoNormal">-- <u></u><u></u></p>
<div>
<p class="MsoNormal">===============================================<br>
David Farmer <a href="mailto:Email%3Afarmer@umn.edu" target="_blank">
Email:farmer@umn.edu</a><br>
Networking & Telecommunication Services<br>
Office of Information Technology<br>
University of Minnesota <br>
2218 University Ave SE Phone: 612-626-0815<br>
Minneapolis, MN 55414-3029 Cell: 612-812-9952<br>
===============================================<u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote></div></div>