RPKI

Route origin validation, without the machinery.

Running a delegated certificate authority requires a server, a published repository and ongoing maintenance. Orbit operates those. You keep the certificate authority and the decisions; the parts nobody wants to operate are ours.

Open the console
01

What you get

A CA under your RIR

Delegated, not shared.

  • Your own certificate authority
  • Delegated from RIPE or another RIR
  • ROAs you create and revoke yourself

A published repository

RRDP and rsync, kept up.

  • Published continuously
  • Mirrored to the anycast network
  • Nothing for you to keep online

RTR for your routers

One endpoint, every VRP.

  • RTR over the anycast address
  • Validated set from the global repositories
  • Works with the routers you already have
02

How the parts fit

A hosted certificate authorityYour registry delegates the address space to you, the certificate authority for it runs here and you add the ROAs, and the repository it publishes is served from every location.Your RIRdelegates the space to youYour CA, run hereyou add the ROAsLocationLocationLocationThe repository is published from every location.
Your registry delegates the address space to you and you add the ROAs. What runs here is the certificate authority and the repository it publishes, which is served from every location.
03

Platform plan allowance

AllowanceFree
Certificate authorities2
ROAs200

Allowances are per account. If you need more, open a ticket at the Help Centre. Usage is in the console. All platform plans

04

Questions

Is there a free tier?

Yes. The Free plan includes 2 certificate authorities and 200 ROAs. Every limit is in the allowance table on this page; if you need more, open a ticket at the Help Centre.

Do I need my own address space?

For a CA, yes — a ROA says which AS may originate a prefix, so the prefix has to be yours. The RTR endpoint is useful to anyone with routers, whether or not they hold address space.

Can I leave later?

Yes. The CA is delegated to you from your RIR; moving it elsewhere, or taking it in-house, is a change at the RIR and does not need our cooperation.