RIPE NCC RPKI Update

In this talk, we will provide an update on recent, ongoing, and upcoming developments for the RIPE NCC RPKI service.

First, we will give a quick update on the work that was done to implement the 2025-02 'Removal of non-functional CAs' policy, the SOC2 type II audit 2026, and BGPsec Router Key Certificates in the API.

Second, we will discuss the ongoing migration of RPKI API keys. We will begin with a brief overview of the existing API—which many operators may not be aware of—and explain our transition to a modern, Single Sign-On (SSO)-integrated architecture. We will outline the steps operators need to take and explain how we are minimizing friction throughout this transition.

The main focus of this talk will be on our plans to improve ROA and ASPA suggestions.

While current ROA suggestions focus primarily on making intended announcements ROV valid, we see that there are many ROAs that have some issues. In particular, they may be stale (no longer needed) or too permissive.

Additionally, we will address the current lack of ASPA suggestions in the dashboard. Initial data analysis indicates that up to 10% of provider ASNs are omitted from ASPA objects—often because they were overlooked or because assumed peers are actually acting as providers without the operator's knowledge.