Richard Jimmerson and ARIN’s RPKI test that missed two validators

ARIN’s RPKI Release Passed Two Tests. Richard Jimmerson Had to Stop the ROA Queue.

Why it matters

The green lights were real. They were also incomplete. In August 2020, two validators accepted ARIN’s freshly upgraded RPKI repository while two others rejected it. Richard Jimmerson’s public response put new ROA requests in a queue until the registry could find out why.

Sofia Ren27 October 2026Reading Time 2 minLast update: 27 October 2026

Richard Jimmerson; likeness from an ARIN photo, operations room imagined.

Summary

Richard Jimmerson’s 12 August notice said ARIN was investigating a possible RPKI bug and queuing new Route Origin Authorization requests. His next-day update identified an encoding error after an HSM upgrade and reported a fix.
ARIN’s 26 August postmortem dates the release to 12 August at 12:21 PM and the fix to 13 August at 11:36 AM. RIPE Validator and Routinator showed no errors; rpki-client and Fort rejected the repository.

At 12:21 PM on 12 August, ARIN deployed a new version of its RPKI system. Twenty-five minutes later came a report that rpki-client could not validate its repository. The release had looked healthy through RIPE Validator and Routinator. The trouble was that a repository has more than two readers. ARIN’s later account says the OpenSSL-based rpki-client and Fort saw a fault the other pair had passed over.

Jimmerson, ARIN’s chief operating officer, made the immediate operational call visible. His notice said new ROA creation requests would wait while the registry investigated and repaired the service. A ROA states which autonomous system may originate an IP prefix; publishing a fresh one during an unresolved repository failure would add new material to a system some relying parties could not read. The queue bought engineering time and told requesters what was happening.

His 13 August update credited Job Snijders with the report and described the problem precisely: the algorithm identifier in one part of a signed object carried an empty parameters value while the corresponding identifier in the part to be signed carried NULL. The two had to match. Jimmerson reported that a fix had been made and that some ROAs created in the interim would need cleanup. He also named the OpenBSD contributors who helped trace the fault.

CTO Mark Kosters’s later timeline puts the repair at 11:36 AM on 13 August. ARIN committed to test future releases against both validator families. That is the hard lesson in a release that had two genuine green lights: compatibility belongs to the set of software that actually consumes the output. Jimmerson’s queue was the human decision made in the gap between the first alarm and that larger test matrix.