Summary

  • AFRINIC's current resource-certification page directly links a 48-page RPKI Certification Practice Statement, version 3.0, published in May 2020.
  • Section V.8 says AFRINIC has sole IANA authority to manage IP address and AS number resources in “the Asia-Pacific region”. AFRINIC and IANA instead place its service region in Africa and the Indian Ocean.
  • APNIC's current CPS uses an almost identical three-sentence termination clause and correctly joins APNIC to Asia-Pacific. The similarity is visible, but it does not prove copying direction or identify the author of AFRINIC's error.
  • The mismatch is a control-document defect, not evidence of a wrong certificate, ROA, allocation, trust anchor, route state or outage. Closure requires a versioned clause-level correction and supersession receipt.

The wrong continent sits in the termination clause

AFRINIC's resource-certification page offers one policy document under its RPKI tools: the Certificate Practice Statement. The link does not lead to an abandoned attachment or an archive label. It leads directly to CPS.

The PDF identifies itself as the AFRINIC Certification Practice Statement for the Resource PKI. Its cover says version 3.0 and records publication in May 2020. The file served during this research was 195,830 bytes. Its SHA-256 fingerprint was 2770e175edbd611c798d0036229a05f3e830843dc4ee202e35e5e944db91d5f0, and the server reported a 28 May 2020 Last-Modified date.

Page 36 contains Section V.8, CA or RA termination. The section says AFRINIC has been granted sole authority by IANA to manage allocation of address space and AS numbers in “the Asia-Pacific region”. The next sentence says AFRINIC established RPKI for its region consistently with that authority. The paragraph ends by saying there are no provisions for termination and transition of the CA function to another entity.

The regional phrase is not a search-index accident. The page was rendered as an image and inspected as well as extracted as text. The words are part of the PDF's ordinary body.

That location matters. A wrong place name in a footer would still deserve correction, but it would not carry the same documentary role. Section V.8 is where the CPS states the institutional basis of the CA and what happens at termination. The region is being used as a premise for the authority claim.

AFRINIC's own pages supply the correction

No complicated inference is required to establish the mismatch. AFRINIC's About page calls the organization the Regional Internet Registry serving Africa and the Indian Ocean. Its service-region page divides the area into Northern, Western, Central, Eastern and Southern Africa plus the Indian Ocean.

IANA publishes the same boundary from the allocation side. Its public guide to the five RIRs assigns AFRINIC to Africa and parts of the Indian Ocean. It assigns APNIC to the Asia/Pacific region. IANA's 2005 AFRINIC recognition report describes the new registry's African and Indian Ocean coverage in detail.

These sources do not create a contest between two plausible service regions. They show a document whose institutional name and geographic predicate do not belong together. The defensible statement is therefore narrow: AFRINIC's current linked CPS contains an incorrect regional description in Section V.8.

The HTTP dates need the same discipline. AFRINIC's resource-certification HTML carried an August 2026 Last-Modified header when captured; the PDF carried its 2020 date. That proves what the two servers delivered and when they said those files last changed. It does not prove that a person reviewed every link or clause in August. A site build, migration or broad deployment can update a page timestamp without re-approving its content.

APNIC shows where the words fit

The strongest comparator is not a generic map. It is APNIC's own current CPS.

APNIC's Section 5.8 uses the same three-part sequence. It says APNIC has IANA authority over address and AS number resources in Asia-Pacific, says APNIC established RPKI for its region on that basis, and says there are no provisions for transitioning the CA function to another entity. In that document, the organization and the region agree.

The correspondence extends beyond one noun. The order, function and wording of the sentences are nearly the same. That makes inherited text a reasonable hypothesis. It does not make it a finding. The frozen sources do not show which document was drafted first, whether both followed a common template, whether AFRINIC adapted an APNIC version, or who approved the final line. Publishing an accusation of copying would trade one documentary overreach for another.

The comparison still performs useful work. It identifies the likely correct pair without asking readers to accept an editorial substitution on trust: APNIC with Asia-Pacific; AFRINIC with Africa and the Indian Ocean. It also shows why a global search-and-replace is unsafe. The sentence about CA transition is shared too, but whether AFRINIC should retain it is a separate decision from correcting the region.

A CPS sentence is not a route state

RPKI documentation sits close to operational infrastructure, which makes it easy to overstate what a prose error can do.

RFC 6484 describes the relationship between the RPKI Certificate Policy and the Certification Practice Statement maintained by each CA. A CPS tells subscribers and relying parties how an operator says it implements the policy. It is consequential evidence about governance and practice. It is not itself a ROA, certificate, manifest, CRL, TAL or validator result.

Nothing in the frozen record shows an AFRINIC certificate carrying an Asia-Pacific label. Nothing shows an address or ASN being allocated to that region because of Section V.8. Nothing shows APNIC losing authority, a trust-anchor key changing, a repository object failing, or a validator producing a different set of validated payloads.

The sources also contain no route measurement tied to this paragraph. They do not show a prefix becoming RPKI Invalid, NotFound or unreachable. They do not show a router rejecting an announcement, a member losing portal access, a key compromise or an outage.

The same boundary applies to continuity. The public clause says there are no provisions for termination and transition of the CA function to another entity. That is a precise public statement. It does not prove AFRINIC has no internal business-continuity plan, no disaster-recovery procedure or no lawful emergency authority. Those are different claims and would require different records.

Treating the PDF error as harmless because no incident is proven would also be wrong. A CPS is the document to which a CA points when describing its practice. If a sentence connecting institution, authority and region is visibly wrong, a relying party cannot know whether it is a single inherited word, an unreviewed paragraph or part of a larger version-control gap. The appropriate response is correction with evidence, not a fictional routing emergency and not indifference.

Do not repair the present by deleting the past

AFRINIC could replace Asia-Pacific with Africa and the Indian Ocean and upload a new file at the same URL. The page would look better immediately. It would leave several audit questions unanswered.

Which version made the change? Who had authority to approve it? Was the change classified as editorial, legal or operational? When did it become effective? Did the sentence about CA transition remain deliberately unchanged? Which bytes were superseded? Where can a later reviewer obtain the version that was public before the correction?

Those questions are not requests for sensitive key material or facility details. They are ordinary document control. A small correction receipt can answer them without disclosing an internal security plan.

The receipt should identify Section V.8 and show the old and new text. It should record the previous PDF hash and the replacement hash, the old and new version numbers, the approver, the authority for approval, and the approval, publication and effective times. It should classify the change: a geographic correction is different from a change to operating practice.

The no-transition sentence needs an explicit disposition. Retained without change, clarified, superseded and governed by a separately linked instrument are distinguishable states. Silence after changing the neighbouring words would force readers to guess whether the whole paragraph was reviewed.

The long-lived current URL should continue to serve the declared replacement. The superseded version should receive an immutable historical URL. A public notice should link both. An independent readback can then record the HTTP status, ETag, PDF length and SHA-256 from the current URL and verify that Section V.8 contains the approved text.

If the correction changes no certificate, key, repository object or service state, the receipt should say document correction only. That negative statement would be more useful than a broad assurance that “RPKI is unaffected”, because it names the surfaces actually checked.

What the evidence does not identify

The file's 2020 date may make the error look old. The evidence does not tell us whether the same phrase appeared in versions 1.0 or 2.0, whether an unpublished review noticed it, or whether a later document already supersedes it elsewhere. The current resource-certification page is the reason version 3.0 remains the relevant public object: that is where AFRINIC still sends a reader looking for the CPS.

Nor can this article identify the responsible desk. A security officer may own the CPS, a legal reviewer may approve terms, an engineering team may maintain the link and a web team may deploy the file. A name on an organizational chart would not prove authorship of one sentence. The receipt should name the accountable role for the correction rather than inviting speculation about an individual.

The article also does not claim that APNIC's no-transition language is a recommended standard for AFRINIC. The comparator establishes textual fit, not policy correctness. AFRINIC's institutional history may make CA succession an important question, but changing that practice would require an authorized decision with its own evidence. It cannot be smuggled into a geographic typo fix.

Make the correction reconstructable

The decisive test is simple. A reader should be able to fetch the current CPS, identify its version, verify its bytes, read the corrected region, see how Section V.8's transition statement was treated, and recover the superseded file.

That chain would convert an embarrassing phrase into evidence of controlled maintenance. It would also preserve a useful institutional boundary. AFRINIC can acknowledge a public document defect without confessing to an unproven network failure. Relying parties can verify the correction without receiving private operational material. Historians and reviewers can reconstruct what the public record said before and after the change.

The wrong region has survived because a long-lived URL can look authoritative even when the bytes behind it age silently. The remedy is not a shorter URL or a stronger adjective. It is a version, an authorized change, an immutable predecessor and a public readback.

Sources