[DBWG] Nonconformant X.509 issuer+subject names in some Afrinic RPKI CA/EE certs

[David Njuki]

Hi Job,

We  are working to resolve the remaining errors/warnings but one presents a challenge, specifically the one that involves constant publication of expired and revoked objects in the repo. I’m sure you’ve noted that the number varies everyday, actually sometimes even within an hour depending on the rcynic RP validation run. 

Narrowing down showed that these are due to a single entity that presently issues and revokes ROAs almost daily and that these objects have short lifetimes. Logging for these presently affects all RP, I am not certain if there is a workaround to make this less noisy but we are open for suggestions. 

The other remaining one which is a warning about "skipped because not is manifest” should be resolved soon as we are already in touch with the member and have a fix for it. 

Regards,
David


> On 17 Aug 2026, at 19:05, Job Snijders <job at bsd.nl> wrote:
> 
> Dear David,
> 
> Thank you for the update and the work that has gone into this project! I appreciate the work that has been done to bring the Afrinic RPKI services in compliance with published IETF standards and fostering interoperability.
> 
> Is there any chance the remaining 25 errors can be resolved visible at https://validator.afrinic.net/rpki/rcynic/rpki.afrinic.net.html ?
> 
> There isn’t much point in publishing expired or otherwise invalid objects, and it clutters the log files and operational visibility.
> 
> Kind regards,
> 
> Job
> 
>> On 17 Aug 2026, at 13:16, David Njuki via DBWG <dbwg at afrinic.net> wrote:
>> 
>> Hi DBWG, Job
>> 
>> We can now confirm that all non-conformant ROAs have been successfully reissued. 
>> 
>> We understand that it has taken sometime to resolve and thank you for your patience. 
>> 
>> Regards,
>> David 
>> 
>> 
>>> On 6 Aug 2026, at 16:29, James Chirwa via DBWG <dbwg at afrinic.net> wrote:
>>> 
>>> Dear Frank, Job, and DBWG Members,
>>> 
>>> We acknowledge receipt of your emails and the queries raised therein.
>>> 
>>> We will provide a response and a comprehensive update on the progress during the course of next week.
>>> 
>>> Regards,
>>> 
>>> James
>>> 
>>> 
>>> On 05/08/2026 02:27, Job Snijders wrote:
>>>> On Wed, Aug 05, 2026 at 12:01:49AM +0300, Frank Habicht wrote:
>>>>> But: after below email from January, should we have received an update
>>>>> between July 31st and now?
>>>>> 
>>>>> Btw: i want to congratulate on this project being completed, in time. But
>>>>> hope for confirmation first that this is the case...
>>>> FYI, there still are ~ 300 ROAs with non-conformant subject/issuer
>>>> names. Please see yellow warning table cells at:
>>>> 
>>>> 	https://validator.afrinic.net/rpki/rcynic/rpki.afrinic.net.html
>>>> 
>>>> Kind regards,
>>>> 
>>>> Job
>>> -- 
>>> James Chirwa
>>> Head of Member Services
>>> African Network Information Centre (AFRINIC) Limited
>>> t: +230 403 51 00 | dir: +230 403 51 42
>>> f: +230 466 6758
>>> w: www.afrinic.net <http://www.afrinic.net/> | tt: @afrinic
>>> SM: facebook.com/afrinic | flickr.com/afrinic | youtube.com/afrinicmedia
>>> _______________________________________________
>>> DBWG mailing list
>>> DBWG at afrinic.net
>>> https://lists.afrinic.net/mailman/listinfo/dbwg
>> 
>> _______________________________________________
>> DBWG mailing list
>> DBWG at afrinic.net
>> https://lists.afrinic.net/mailman/listinfo/dbwg

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.afrinic.net/pipermail/dbwg/attachments/20260818/811962c7/attachment.html>