Summary

  • Nathalie Trenaman announced a staged end for the RIPE NCC RPKI Validator: new features stopped on 1 January 2021, new RFC and RIR-policy support on 1 March, and all maintenance on 1 July. The registry kept security fixes flowing until the final date.
  • In June 2021 the RIPE NCC urged remaining users to move to maintained relying-party software. Support ended as planned; the public informational validator website moved to a different engine later that September.

Retiring a security tool sounds like taking the smoke alarm off the wall. Nathalie Trenaman’s October 2020 RIPE Labs account explains why the analogy breaks down. The RIPE NCC had built its RPKI Validator when the ecosystem was young. Version 2 went live on 13 December 2011; its web interface let operators preview how route-origin validation might affect BGP announcements. Later came a Java rewrite, a memory problem in version 3 and a substantial overhaul before version 3.1 arrived in July 2019. Maintaining a validator was now a continuing security job, not an old product waiting politely on a shelf.

Trenaman wrote that the RIPE NCC saw about 450 active instances of its Validator in October 2020. She did not ask those users to change overnight. The plan had three steps: stop building new features on 1 January 2021, stop implementing new RFCs and RIR policies on 1 March, then end maintenance and archive the tool on 1 July. Security fixes continued until that last date. She also promised outreach and updated training material so operators had time to choose another maintained validator.

Her reason was a question of where a regional registry should spend scarce engineering attention. The RIPE NCC remains responsible for a secure, stable RPKI certificate authority. A relying-party validator is software operators run to download and check the global RPKI data set before using its results in routing decisions. Those are two different jobs. Keeping a homegrown validator current while other maintained choices existed drew effort from the certificate service the registry had to operate.

The RIPE NCC’s June notice turned the timetable into a direct instruction: switch before 1 July. An unsupported validator would no longer receive updates. The registry’s July member update confirmed the support stop. A further distinction mattered in September: the public rpki-validator.ripe.net site had been an informational window onto the old software. Trenaman’s migration note said that window was moving to Routinator. The public web page continuing to answer was a new front end, not a reason to keep an unmaintained binary in production.

That is the unusual leadership choice in this story. Trenaman gave a product with real users a dated, public ending, while protecting the RIPE NCC’s core certificate work. Security sometimes means saying goodbye to a tool you once needed, then making the handoff boring enough that operators can plan it.