Summary

  • LACNIC began replacing its RPKI core in late 2022. Jorge Cano says the team tested multiple validator versions because preserving their caches was one of the most delicate parts of the migration; some older versions needed a restart.
  • After adapting the new core to LACNIC’s member database, the final production switch was a DNS-record change. Cano later described an offline master key and three witnessed signing ceremonies for the trust anchor.

The audience was already caching the show

LACNIC could choose its new engine. It could not choose when every relying party would refresh its view. That is why the most revealing line in Cano’s migration account concerns validator caches. He calls their integrity one of the delicate parts of changing the RPKI core. The team tried different versions of different validators. Some older versions required an operator to restart them. A migration that looks complete on the registry’s own dashboard can still leave the audience holding yesterday’s programme.

Cano, LACNIC’s senior software architect, describes three working layers: a core that handles cryptography, a publication and pre-validation layer that checks the material, and a front end that serves the validated result. Members using hosted RPKI make Route Origin Authorizations in MiLACNIC; LACNIC keeps the keys and certificates behind that interface. For those members, the registry’s engine room is a service they depend on without entering it.

The replacement project started in late 2022. LACNIC selected the open-source Krill implementation for its core and spent roughly two years adapting the system to its users’ database and registry-specific work. Then came the line that makes infrastructure people smile: the final move into production was a change to DNS records. DNS was the handle on a much longer job. The validator tests, the publication path and the data adaptation made that handle safe enough to turn.

There was another handle Cano wanted kept out of daily reach. In his January 2025 account, LACNIC’s master trust-anchor key lives offline and is activated briefly to re-sign the certificate above its RPKI objects. He describes three completed signing ceremonies at Casa de Internet in Uruguay, with staff from different departments and witnesses. A checklist records the steps and exceptions. The ceremony is where a rare, powerful action becomes a sequence other people can inspect. LACNIC has not published the validator-version test matrix; that record would show exactly which old caches needed help.