NLnetLabs / krill

RPKI Certificate Authority and Publication Server written in Rust
https://nlnetlabs.nl/projects/routing/krill/
Mozilla Public License 2.0
289 stars 40 forks source link

BUG: Let testbed automatically renew TA manifest and CRL #1095

Closed timbru closed 11 months ago

timbru commented 1 year ago

The following work around will work...

1) Configure things so you can use the "krillta" command line tool:

Create "/etc/krillta.conf" with the following content: data = "/var/lib/krill/data"

Under "/var/lib/krill/data" - remove the directory called "signer" if it exists and make a symlink like:

cd /var/lib/krill/data ln -s ./ta_signer ./signer

If you now do "krillta signer show" then you should see a response.

2) Perform an exchange between the TA "proxy" and "signer"

As described here: https://krill.docs.nlnetlabs.nl/en/stable/trust-anchor.html#typical-proxy-signer-exchange

NOTE: when this fix is implemented we should make sure that krillta and the embedded testbed TA in krill use the same namespace. I.e. probably ta_signer as used by the embedded TA because it's slightly more clear than the plain signer as is used by krillta.