Summary

  • A BGPsec Router Certificate binds one or more AS numbers to a public key whose private counterpart may sign BGPsec updates; it does not authorize those ASes to originate a prefix.
  • A Route Origin Authorization supplies the separate prefix-to-origin-AS statement, while private-key control, router deployment, cache delivery, export policy and an observed signed update remain additional facts.
  • A useful operations ledger records each fact with its own issuer, validity interval and observation time instead of collapsing them into “RPKI valid.”

The distinction is small in syntax and large in consequence. RFC 8209 describes an end-entity certificate for a router and identifies its essential function as a secure binding between AS numbers and a public key. RFC 8205 uses that key in BGPsec path signatures. A ROA, by contrast, expresses that a specified AS may originate specified IP prefixes. Those are related assertions, not interchangeable ones.

This means a signature answers a bounded question: did a holder of the corresponding private key sign a secure route advertisement on behalf of the stated AS? It does not answer whether that AS held current origin authority for the announced prefix, whether local export policy allowed the route, or whether every system saw the same validated data at the same time.

The certificate also has its own lifecycle. Its AS Resources extension scopes the AS numbers for which the key may act. RFC 8209 notes that if a certificate covers several AS numbers and one is removed from the issuing CA certificate, the router certificate becomes invalid. Per-AS certificates can reduce that coupling, although they increase the number of objects and rotations an operator must manage.

An evidence ledger should therefore keep separate rows for certificate issuance and revocation, AS scope, possession and deployment of the private key, validated router-key delivery, ROA state for the prefix, local export policy, and the peer-specific signed update actually observed. Joining those rows can support an explanation; none alone is the whole explanation.