1RPKI-CLIENT(8) BSD System Manager's Manual RPKI-CLIENT(8)
2
4 rpki-client — RPKI validator to support BGP Origin Validation
5
7 rpki-client [-BcjnoRrVv] [-b sourceaddr] [-d cachedir] [-e rsync_prog]
8 [-s timeout] [-T table] [-t tal] [outputdir]
9 rpki-client [-Vv] [-d cachedir] [-t tal] -f file ...
10
12 The rpki-client utility queries the RPKI repository system with a built-
13 in HTTP client and rsync(1) to fetch all X.509 certificates, manifests,
14 and revocation lists under a given Trust Anchor. rpki-client subse‐
15 quently validates each Signed Object by constructing and verifying a cer‐
16 tification path for the certificate associated with the Object (including
17 checking relevant CRLs). rpki-client produces lists of the Validated ROA
18 Payloads (VRPs) and BGPsec Router Keys (BRKs) in various formats.
19 The options are as follows:
21 -B Create output in the files bird1v4, bird1v6, and bird (for bird2)
23 in the output directory which is suitable for the BIRD internet
24 routing daemon.
25 -b sourceaddr
27 Tell the HTTP and rsync clients to use sourceaddr as the source
28 address for connections, which is useful on machines with multi‐
29 ple interfaces.
30 -c Create output in the file csv in the output directory as comma-
32 separated values of the Autonomous System, the prefix in slash
33 notation, the maximum prefix length, an abbreviation for the
34 Trust Anchor the entry is derived from, and the moment the VRP
35 will expire derived from the chain of X.509 certificates and CRLs
36 in seconds since the Epoch, UTC.
37 -d cachedir
39 The directory where rpki-client will store the cached repository
40 data. Defaults to /var/cache/rpki-client.
41 -e rsync_prog
43 Use rsync_prog instead of rsync(1) to fetch repositories. It
44 must accept the -rt and --address flags and connect with rsync-
45 protocol locations.
46 -f file ...
48 Validate the Signed Object in file against the RPKI cache stored
49 in cachedir and print human-readable information about the ob‐
50 ject. If file is an rsync:// URI, the corresponding file from
51 the cache will be used. This option implies -n.
52 -j Create output in the file json in the output directory as JSON
54 object. See -c for a description of the fields.
55 -n Offline mode. Validate the contents of cachedir and write to
57 outputdir without synchronizing via RRDP or RSYNC.
58 -o Create output in the file openbgpd in the output directory as
60 bgpd(8) compatible input. If the -B, -c, and -j options are not
61 specified this is the default.
62 -R Synchronize via RSYNC only.
64 -r Synchronize via RRDP. If RRDP fails, RSYNC will be used. This
66 is the default. Mutually exclusive with -n.
67 -s timeout
69 Terminate after timeout seconds of runtime, because normal prac‐
70 tice will restart from cron(8). Disable by specifying 0. De‐
71 faults to 1 hour. Individual Publication Points are timed out
72 after one fourth of timeout.
73 -T table
75 For BIRD output generated with the -B option use table as roa ta‐
76 ble name instead of the default 'ROAS'.
77 -t tal Specify a Trust Anchor Location (TAL) file to be used. This op‐
79 tion can be used multiple times to load multiple TALs. By de‐
80 fault rpki-client will load all TAL files in /etc/pki/tals.
81 -V Show the version and exit.
83 -v Specified once, prints information about status. Twice, prints
85 each filename as it's processed.
86 outputdir
88 The directory where rpki-client will write the output files. De‐
89 faults to /var/lib/rpki-client.
90 By default rpki-client produces a list of unique VRPs in -joBc JSON,
92 OpenBGPD, BIRD and CSV compatible output.
93 rpki-client should be run hourly by cron(8): use crontab(1) to uncomment
95 the entry in root's crontab.
96
98 rpki-client utilizes the following environment variables:
99 http_proxy URL of HTTP proxy to use.
101
103 /etc/pki/tals/*.tal default TAL files used unless -t tal is
104 specified.
105 /var/cache/rpki-client cached repository data.
106 /var/lib/rpki-client/openbgpd default roa-set output file.
107
109 The rpki-client utility exits 0 on success, and >0 if an error occurs.
110
112 rsync(1), bgpd.conf(5)
113
115 The following standards are used or referenced in rpki-client:
116 RFC 3370
118 Cryptographic Message Syntax (CMS) Algorithms.
119 RFC 3779
121 X.509 Extensions for IP Addresses and AS Identifiers.
122 RFC 4291
124 IP Version 6 Addressing Architecture.
125 RFC 4631
127 Classless Inter-domain Routing (CIDR): The Internet Address Assign‐
128 ment and Aggregation Plan.
129 RFC 5280
131 Internet X.509 Public Key Infrastructure Certificate and Certificate
132 Revocation List (CRL) Profile.
133 RFC 5652
135 Cryptographic Message Syntax (CMS).
136 RFC 5781
138 The rsync URI Scheme.
139 RFC 5952
141 A Recommendation for IPv6 Address Text Representation.
142 RFC 6480
144 An Infrastructure to Support Secure Internet Routing.
145 RFC 6482
147 A Profile for Route Origin Authorizations (ROAs).
148 RFC 6485
150 The Profile for Algorithms and Key Sizes for Use in the Resource
151 Public Key Infrastructure (RPKI).
152 RFC 6486
154 Manifests for the Resource Public Key Infrastructure (RPKI).
155 RFC 6487
157 A Profile for X.509 PKIX Resource Certificates.
158 RFC 6488
160 Signed Object Template for the Resource Public Key Infrastructure
161 (RPKI).
162 RFC 6493
164 The Resource Public Key Infrastructure (RPKI) Ghostbusters Record.
165 RFC 8182
167 The RPKI Repository Delta Protocol (RRDP).
168 RFC 8209
170 A Profile for BGPsec Router Certificates, Certificate Revocation
171 Lists, and Certification Requests.
172 RFC 8630
174 Resource Public Key Infrastructure (RPKI) Trust Anchor Locator.
175
177 rpki-client first appeared in OpenBSD 6.7.
178
180 The rpki-client utility was written by Kristaps Dzonsons
181 <kristaps@bsd.lv>.
182BSD March 31, 2022 BSD