Summary

  • ARIN suggestion 2022.26 asked for a way to run hosted and delegated RPKI together during a switch. Its submitter described an organisation with 515 prefixes, several ROAs per prefix, and a 25-hour recreation estimate at its chosen pace. Those figures describe the operator’s 2022 case.
  • ARIN accepted the problem for investigation in November 2022. The request is still listed as Open; the current RPKI FAQ tells organisations changing deployment model to contact Registration Services.

Moving a certificate authority should be an engineering change. For a large ROA set, it can become a test of whether the registry has designed a bridge or merely posted the phone number of someone who might help build one.

The original ARIN suggestion is unusually concrete. Michael Drzal said his largest organisation held 515 prefixes, each covered by multiple Route Origin Authorizations. Switching from ARIN-hosted to delegated RPKI, he wrote, invalidated existing ROAs and required their recreation. His team deliberately limited its rate of ROA changes to avoid routing mistakes; at that rate, it estimated 25 hours to rebuild the set. He asked to operate both models within one organisation during the transition. This was a customer's stated configuration and timetable in 2022, not a measured outage in 2026.

ARIN's November 2022 reply agreed that a transition feature could help large holders and said it would investigate requirements and schedule development. At ARIN 52 in October 2023, staff again described a request to assist hosted-to-delegated moves. The active suggestions register still labels 2022.26 Open. Four years have produced a durable request, but the reviewed public record supplies no implementation receipt for a dual-mode handover.

Today's FAQ offers a human route: contact Registration Services for assistance. Its general timing notes say ARIN publishes its repository every five minutes and a new ROA may take 30 to 60 minutes to affect routing. Those timers cannot be pasted onto Drzal's migration as a guaranteed gap. They do show why publication order, validator observation and a matched inventory of old and new authorizations matter. A help-desk ticket can coordinate people; a published procedure can tell an operator exactly what will be preserved and how to prove it.

ARIN's deployment description draws the control line cleanly. In hosted RPKI, ARIN signs the ROAs. In delegated RPKI, the holder runs its certificate authority, while ARIN remains the trust anchor. The switch moves signing responsibility toward the operator. Its first practical test is whether the operator can change custody without losing a verifiable chain of routing authorizations.

ARIN has not published, in these reviewed records, a completed transition sequence showing old and new CA overlap, ROA-set comparison, rollback steps and what validators observed. A current assisted-transition procedure with those facts would change this assessment. Until then, the public answer to a control-plane handover remains a service desk, and 2022.26 remains on the open list.