RIPE's invisible RPKI files still get downloaded

RIPE's Invisible RPKI Files Still Have a Delivery Route

Why it matters

Some certification authorities have no resources and vanish from validator view. Their leftover publication data still travels to relying parties.

Theo March2 November 2026Reading Time 2 minLast update: 2 November 2026

RIPE NCC says resource-less CA remnants remain in publication and cause additional relying-party downloads.

Summary

At RIPE 93, RIPE NCC said remnants of some CAs with no resources do not appear in validators, yet some of their content remains in its publication service.
Relying parties still download extra data from that residue. RIPE NCC is cleaning it up; its public update gives no count or transfer volume.

The registry has two views of the same mess. One is the certificate chain a validator can use. The other is the publication service from which a relying party fetches RPKI material. RIPE NCC has acknowledged a gap between them: some resource-less certification authorities have disappeared from the first view while leftovers remain in the second.

Tim Bruijnzeels put the point plainly at the RIPE 93 Routing Working Group on 28 October. The CAs have no resources, he said, so they do not show up in validators. Some content remains in the publication service and causes additional data to be downloaded by relying parties. His team is still cleaning it up. A silent validator screen is a poor receipt for a tidy repository.

The RIPE NCC Publish in Parent terms describe a public repository for certificates, revocation lists and signed RPKI objects. That repository is an operating surface, not merely a display of valid route decisions. Files can continue to impose retrieval work after the corresponding CA has ceased to matter to validator output.

Bruijnzeels also reported that RIPE NCC removed 35 non-functional delegated CAs in September under its separate 90-day policy. The transcript does not identify the resource-less remnants as belonging to those 35. One operation revoked persistently broken certificates; the other is sweeping files still served by a publication system. The common bill lands at the relying party, but the cleanup levers differ.

RIPE NCC has published no count of these remnants or measurement of the extra bytes in this update. A repository inventory and before-and-after transfer figures would put a size on the bill. For now the institution’s own engineer confirms the bill exists and the sweep is unfinished.