Manifest certificate has expired

mk0294 · September 7, 2026, 1:00am

Without really thinking of the implications I shutdown my lab RPKI environment for about 4 days. Now Routinator is showing the publication point for the parent CA as being rejected. See the log below:

2026-09-05T16:18:59.967097-04:00 rpkirelay0101 routinator[14057]: New serial is 0.
2026-09-05T16:18:59.967378-04:00 rpkirelay0101 routinator[14057]: Sending out notifications.
2026-09-05T16:18:59.967575-04:00 rpkirelay0101 routinator[14057]: Initial run complete, now starting normal run.
2026-09-05T16:18:59.967807-04:00 rpkirelay0101 routinator[14057]: Next validation run scheduled in 0 seconds
2026-09-05T16:18:59.967968-04:00 rpkirelay0101 routinator[14057]: Starting a validation run.
2026-09-05T16:18:59.968142-04:00 rpkirelay0101 routinator[14057]: Using the following TALs:
2026-09-05T16:18:59.968329-04:00 rpkirelay0101 routinator[14057]: * ta
2026-09-05T16:19:00.011970-04:00 rpkirelay0101 routinator[14057]: Found valid trust anchor https://rpkica01.local/ta/ta.cer. Processing.
2026-09-05T16:19:00.017808-04:00 rpkirelay0101 routinator[14057]: RRDP https://rpkica01.local/rrdp/notification.xml: Not modified.
2026-09-05T16:19:00.018200-04:00 rpkirelay0101 routinator[14057]: rsync://rpkica01.local/repo/: manifest rsync://rpkica01.local/repo/36E78CD194CE3F139A3CF6C87447292508CF0530.mft: certificate has expired.
2026-09-05T16:19:00.018462-04:00 rpkirelay0101 routinator[14057]: rsync://rpkica01.local/repo/: no valid manifest rsync://rpkica01.local/repo/36E78CD194CE3F139A3CF6C87447292508CF0530.mft found.
2026-09-05T16:19:00.024586-04:00 rpkirelay0101 routinator[14057]: Validation completed in 0 seconds.

My environment consists of an offline Trust Anchor, Parent CA and one child CA with one publication server and two repository servers.

In the Krill UI for both the Parent and Child CA both are showing green under the Parents and Repository sections with recent exchanges, could you help with the steps required to recover?

Koen · September 7, 2026, 12:12pm

You probably want to do a krillc bulk publish, see also Using the CLI or API — Krill 0.16.0 documentation

(Or just wait a bit, it should renew it automatically as well)

mk0294 · September 8, 2026, 1:32am

I ran krillc bulk publish on the parent and child CA’s with the same result showing in Routinator. Before running that command the systems were up and running for hours before I discovered the issue.

Koen · September 8, 2026, 10:21am

Hmmm, that’s strange. Do the Krill logs show anything unusual? And just to be sure: the machine’s time is correct?

mk0294 · September 9, 2026, 12:27am

Double checked all servers for correct date and time, they are synced to the same NTP server as well.

Krill log from the parent CA (Enabled debug and restarted the krill service)

root@rpkica0101:/home/sysadmin# tail -f /var/log/syslog | grep krill
2026-09-08T14:01:15.314986-04:00 rpkica0101 krill[727]: 2026-09-08 14:01:15 [ERROR] Failed to update BGP announcements: Failed to download RISwhois file https://www.ris.ripe.net/dumps/riswhoisdump.IPv4.gz: error sending request for url (https://www.ris.ripe.net/dumps/riswhoisdump.IPv4.gz)
2026-09-08T14:07:19.388350-04:00 rpkica0101 systemd[1]: Stopping krill.service - Krill…
2026-09-08T14:07:19.393104-04:00 rpkica0101 systemd[1]: krill.service: Deactivated successfully.
2026-09-08T14:07:19.394375-04:00 rpkica0101 systemd[1]: Stopped krill.service - Krill.
2026-09-08T14:07:19.394702-04:00 rpkica0101 systemd[1]: krill.service: Consumed 7min 51.252s CPU time, 25.6M memory peak, 0B memory swap peak.
2026-09-08T14:07:19.430023-04:00 rpkica0101 systemd[1]: Starting krill.service - Krill…
2026-09-08T14:07:19.588778-04:00 rpkica0101 systemd[1]: Started krill.service - Krill.
2026-09-08T14:07:19.602724-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:19 [INFO] [krill::config] Krill uses configuration file: /etc/krill.conf
2026-09-08T14:07:19.603214-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:19 [DEBUG] [krill::upgrades] Signers were set up before. No need to migrate keys.
2026-09-08T14:07:19.604352-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:19 [INFO] [krill::server::manager] Starting Krill v0.16.0
2026-09-08T14:07:19.604794-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:19 [INFO] [krill::server::manager] Krill uses service uri: https://rpkica01.svc.local/
2026-09-08T14:07:19.605088-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:19 [INFO] [krill::commons::crypto::signing::dispatch::krillsigner] Configuring signer ‘Default OpenSSL signer’ (type: OpenSSL, default: true, one_off: true)
2026-09-08T14:07:19.614416-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:19 [DEBUG] [krill::server::mq] add task: queue_start_tasks with priority: 2026-09-08T18:07:19+00:00
2026-09-08T14:07:19.617054-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:19 [DEBUG] [krill::server::scheduler] Adding missing tasks at start up
2026-09-08T14:07:19.617299-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:19 [DEBUG] [krill::server::scheduler] Adding tasks for CA online, using jitter: false
2026-09-08T14:07:19.617496-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:19 [DEBUG] [krill::server::mq] add task: sync_online_with_parent_ta with priority: 2026-09-08T18:07:19+00:00
2026-09-08T14:07:19.617738-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:19 [DEBUG] [krill::server::mq] add task: sync_repo_online with priority: 2026-09-08T18:07:19+00:00
2026-09-08T14:07:19.617938-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:19 [DEBUG] [krill::server::mq] add task: all_cas_republish_if_needed with priority: 2026-09-08T18:07:19+00:00
2026-09-08T14:07:19.618190-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:19 [DEBUG] [krill::server::mq] add task: all_cas_renew_objects_if_needed with priority: 2026-09-08T18:07:19+00:00
2026-09-08T14:07:19.618350-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:19 [DEBUG] [krill::server::mq] add task: refresh_bgp_announcements_info with priority: 2026-09-08T18:07:19+00:00
2026-09-08T14:07:19.618544-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:19 [DEBUG] [krill::server::mq] add task: update_stored_snapshots with priority: 2026-09-08T18:07:19+00:00
2026-09-08T14:07:19.620484-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:19 [DEBUG] [krill::server::mq] Finish task: 1788890839615-queue_start_tasks
2026-09-08T14:07:19.649555-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:19 [DEBUG] [rustls_platform_verifier::verification::others] Loaded 109 CA root certificates from the system
2026-09-08T14:07:24.666136-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:24 [DEBUG] [krill::server::mq] add task: refresh_bgp_announcements_info with priority: 2026-09-08T18:17:24+00:00
2026-09-08T14:07:24.666730-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:24 [INFO] [krill::server::scheduler] Synchronize CA online with repository
2026-09-08T14:07:24.666929-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:24 [DEBUG] [krill::server::ca::manager] CA ‘online’ sends list query to repo
2026-09-08T14:07:24.667475-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:24 [DEBUG] [krill::server::pubd::manager] Received RFC 8181 list query for online
2026-09-08T14:07:24.667951-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:24 [DEBUG] [krill::server::ca::manager] CA ‘online’ has nothing to publish
2026-09-08T14:07:24.668872-04:00 rpkica0101 krill[23215]: 2026-09-08 14:07:24 [DEBUG] [krill::server::mq] Finish task: 1788890844664-sync_repo_online
2026-09-08T14:09:25.079574-04:00 rpkica0101 krill[23215]: 2026-09-08 14:09:25 [DEBUG] [krill::server::ca::publishing] Re-issue for CA online using force: false
2026-09-08T14:09:25.081990-04:00 rpkica0101 krill[23215]: 2026-09-08 14:09:25 [DEBUG] [krill::server::mq] add task: all_cas_republish_if_needed with priority: 2026-09-08T18:14:25+00:00
2026-09-08T14:14:25.077053-04:00 rpkica0101 krill[23215]: 2026-09-08 14:14:25 [DEBUG] [krill::server::ca::publishing] Re-issue for CA online using force: false
2026-09-08T14:14:25.081728-04:00 rpkica0101 krill[23215]: 2026-09-08 14:14:25 [DEBUG] [krill::server::mq] add task: all_cas_republish_if_needed with priority: 2026-09-08T18:19:25+00:00
2026-09-08T14:17:24.196628-04:00 rpkica0101 krill[23215]: 2026-09-08 14:17:24 [DEBUG] [rustls_platform_verifier::verification::others] Loaded 109 CA root certificates from the system
2026-09-08T14:17:29.213775-04:00 rpkica0101 krill[23215]: 2026-09-08 14:17:29 [DEBUG] [krill::server::mq] add task: refresh_bgp_announcements_info with priority: 2026-09-08T18:27:29+00:00
2026-09-08T14:19:25.105284-04:00 rpkica0101 krill[23215]: 2026-09-08 14:19:25 [DEBUG] [krill::server::ca::publishing] Re-issue for CA online using force: false
2026-09-08T14:19:25.110155-04:00 rpkica0101 krill[23215]: 2026-09-08 14:19:25 [DEBUG] [krill::server::mq] add task: all_cas_republish_if_needed with priority: 2026-09-08T18:24:25+00:00
2026-09-08T14:24:25.098509-04:00 rpkica0101 krill[23215]: 2026-09-08 14:24:25 [DEBUG] [krill::server::ca::publishing] Re-issue for CA online using force: false
2026-09-08T14:24:25.100286-04:00 rpkica0101 krill[23215]: 2026-09-08 14:24:25 [DEBUG] [krill::server::mq] add task: all_cas_republish_if_needed with priority: 2026-09-08T18:29:25+00:00
2026-09-08T14:27:29.233339-04:00 rpkica0101 krill[23215]: 2026-09-08 14:27:29 [DEBUG] [rustls_platform_verifier::verification::others] Loaded 109 CA root certificates from the system
2026-09-08T14:27:34.357947-04:00 rpkica0101 krill[23215]: 2026-09-08 14:27:34 [DEBUG] [krill::server::mq] add task: refresh_bgp_announcements_info with priority: 2026-09-08T18:37:34+00:00
2026-09-08T14:29:25.237160-04:00 rpkica0101 krill[23215]: 2026-09-08 14:29:25 [DEBUG] [krill::server::ca::publishing] Re-issue for CA online using force: false
2026-09-08T14:29:25.238471-04:00 rpkica0101 krill[23215]: 2026-09-08 14:29:25 [DEBUG] [krill::server::mq] add task: all_cas_republish_if_needed with priority: 2026-09-08T18:34:25+00:00
2026-09-08T14:34:25.229764-04:00 rpkica0101 krill[23215]: 2026-09-08 14:34:25 [DEBUG] [krill::server::ca::publishing] Re-issue for CA online using force: false
2026-09-08T14:34:25.231364-04:00 rpkica0101 krill[23215]: 2026-09-08 14:34:25 [DEBUG] [krill::server::mq] add task: all_cas_republish_if_needed with priority: 2026-09-08T18:39:25+00:00
2026-09-08T14:34:55.337407-04:00 rpkica0101 krill[23215]: 2026-09-08 14:34:55 [DEBUG] [krill::server::mq] add task: all_cas_renew_objects_if_needed with priority: 2026-09-08T19:34:55+00:00
2026-09-08T14:37:34.376451-04:00 rpkica0101 krill[23215]: 2026-09-08 14:37:34 [DEBUG] [rustls_platform_verifier::verification::others] Loaded 109 CA root certificates from the system
2026-09-08T14:37:39.391263-04:00 rpkica0101 krill[23215]: 2026-09-08 14:37:39 [DEBUG] [krill::server::mq] add task: refresh_bgp_announcements_info with priority: 2026-09-08T18:47:39+00:00
2026-09-08T14:39:25.235788-04:00 rpkica0101 krill[23215]: 2026-09-08 14:39:25 [DEBUG] [krill::server::ca::publishing] Re-issue for CA online using force: false
2026-09-08T14:39:25.237338-04:00 rpkica0101 krill[23215]: 2026-09-08 14:39:25 [DEBUG] [krill::server::mq] add task: all_cas_republish_if_needed with priority: 2026-09-08T18:44:25+00:00
2026-09-08T14:44:25.252556-04:00 rpkica0101 krill[23215]: 2026-09-08 14:44:25 [DEBUG] [krill::server::ca::publishing] Re-issue for CA online using force: false
2026-09-08T14:44:25.266071-04:00 rpkica0101 krill[23215]: 2026-09-08 14:44:25 [DEBUG] [krill::server::mq] add task: all_cas_republish_if_needed with priority: 2026-09-08T18:49:25+00:00
2026-09-08T14:47:39.402499-04:00 rpkica0101 krill[23215]: 2026-09-08 14:47:39 [DEBUG] [rustls_platform_verifier::verification::others] Loaded 109 CA root certificates from the system
2026-09-08T14:47:44.420490-04:00 rpkica0101 krill[23215]: 2026-09-08 14:47:44 [DEBUG] [krill::server::mq] add task: refresh_bgp_announcements_info with priority: 2026-09-08T18:57:44+00:00
2026-09-08T14:48:54.723841-04:00 rpkica0101 krill[23215]: 2026-09-08 14:48:54 [DEBUG] [krill::commons::crypto::signing::dispatch::signerrouter] Signer ‘Default OpenSSL signer’ is ready and known, binding
2026-09-08T14:48:54.725827-04:00 rpkica0101 krill[23215]: 2026-09-08 14:48:54 [DEBUG] [krill::commons::crypto::signing::dispatch::signerrouter] Signer ‘Default OpenSSL signer’ bound to signer mapper handle ‘8d745186-5a83-4994-afc9-465252be7615’
2026-09-08T14:48:54.726538-04:00 rpkica0101 krill[23215]: 2026-09-08 14:48:54 [INFO] [krill::commons::crypto::signing::dispatch::signerrouter] Signer ‘Default OpenSSL signer’ is ready for use
2026-09-08T14:49:25.230651-04:00 rpkica0101 krill[23215]: 2026-09-08 14:49:25 [DEBUG] [krill::server::ca::publishing] Re-issue for CA online using force: false
2026-09-08T14:49:25.234353-04:00 rpkica0101 krill[23215]: 2026-09-08 14:49:25 [DEBUG] [krill::server::mq] add task: all_cas_republish_if_needed with priority: 2026-09-08T18:54:25+00:00
2026-09-08T14:54:25.195643-04:00 rpkica0101 krill[23215]: 2026-09-08 14:54:25 [DEBUG] [krill::server::ca::publishing] Re-issue for CA online using force: false
2026-09-08T14:54:25.197278-04:00 rpkica0101 krill[23215]: 2026-09-08 14:54:25 [DEBUG] [krill::server::mq] add task: all_cas_republish_if_needed with priority: 2026-09-08T18:59:25+00:00
2026-09-08T14:57:44.363416-04:00 rpkica0101 krill[23215]: 2026-09-08 14:57:44 [DEBUG] [rustls_platform_verifier::verification::others] Loaded 109 CA root certificates from the system

mk0294 · September 14, 2026, 2:49am

Any other suggestions? Still browken

partim · September 14, 2026, 11:45am

Not sure what’s going wrong. Can you submit the output of both krillc show --ca <child-ca> and krillc parents statuses --ca <child-ca> on the child instance?

mk0294 · September 14, 2026, 11:54am

krillc show --ca RPKICA
Name: RPKICA

Base uri: rsync://rpkirepo01.local/repo/RPKICA/
RRDP uri: https://rpkirepo01.local/rrdp/notification.xml

ID cert PEM:
-----BEGIN CERTIFICATE-----
MIIDEzCCAfugAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygzQkU2
OTY5QUVBRUQzMTUwREVCOTU4NDg0OEMwMDExRkMwNTBGNDk0MB4XDTI2MDUwODAz
MDkzM1oXDTQxMDUwODAzMTQzM1owMzExMC8GA1UEAxMoM0JFNjk2OUFFQUVEMzE1
MERFQjk1ODQ4NDhDMDAxMUZDMDUwRjQ5NDCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBALNn3F6sd4YGeuzAIEwcvYlVSGzW3ColL++aSpG3+HnYFbS5t9TI
38vGtXelr+FZmb6TvTYDMsVGxBZvx0LajxiAtQns1CyoU9PnRlby3WGYN5Rx5pA4
I7Dlv2F6qi3EYrDRYDrOdkPNpo5Hs8kYM369yASqt3Exolqp5RK9wm+dI6YFw7BK
TEtSQ+pOftVgZhqsxTpCfTIT16RORR1u0hCwsAZ/nrqG9LAWUZNQXyjc+rqsBjvx
qAZW2/ddZF6m/UKEBq+RBLugfkmzK78AEkCPheApW89QArMtDCPj8lod24Adr0le
YUrHBZWEbMsGsEu/N+2OI1rxNeEstFBDUlUCAwEAAaMyMDAwDwYDVR0TAQH/BAUw
AwEB/zAdBgNVHQ4EFgQUO+aWmurtMVDeuVhISMABH8BQ9JQwDQYJKoZIhvcNAQEL
BQADggEBACViJiOjtqKfUMJGMotefeI3icPbVm65DHgpvTeuXVqqRdZ/X/N+4n6L
pPHWNrFBIcAzc9kpIEhUbyZPzCjjUOFHcQiaeT8eI2L1G4PVF0oZfqvK2qRCGdj9
ekmnpIHySq5x0BxEBguxzLFVjpIm9mXtehxhEyucWvflwQHQrNJChOwoSvOYVVcp
+ubLx7y8MVTgN6JNXtpH20NxDusSYiOUHbeMVd09/RWJz2I956cUjpWEke2dLgoS
nvbQavyQ0yTsABg88eFMIjd2m2LoWqOqjA3KeSF9zfAUZQOyDbTYjHAgTzH6vDwc
2tOCI390EJH0BEnJlQDcWVU3s6WCjEo=
-----END CERTIFICATE-----

Hash: f7d506ff2e6da032b0faf7cb5687201d2a410fbe8c9b6c1daf3b32d3b19e31ff

Total resources:
ASNs: AS64512-AS65534
IPv4: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
IPv6:

Parents:
Handle: online Kind: RFC 6492 Parent

Resource Class: 0
Parent: online
State: active
Resources:
ASNs: AS64512-AS65534
IPv4: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
IPv6:

Children:

krillc parents statuses --ca RPKICA
Parent: online
URI: https://rpkica01.local/rfc6492/online
Status: success
Last contacted: 2026-09-13T21:57:37+00:00
Resource Entitlements: asn: ‘AS64512-AS65534’, ipv4: ‘10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16’, ipv6: ‘’
resource class: 0
entitled resources: asn: ‘AS64512-AS65534’, ipv4: ‘10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16’, ipv6: ‘’
entitled not after: 2027-05-08T03:43:57+00:00
issuing cert uri: rsync://rpkica01.local/repo/5E6F7F2E9335479814844CC7BF3A0787E707D886.cer
issuing cert PEM:

received certificate(s):
published at: rsync://rpkica01.local/repo/online/0/470E95DF2A08FA840D29CD50FBD2C33A14780098.cer
cert PEM:

partim · September 14, 2026, 12:18pm

That looks all fine. What does krillc repo status --ca RPKICA say?

mk0294 · September 14, 2026, 12:21pm

krillc repo status --ca RPKICA
URI: https://rpkipub01.local/rfc8181/RPKICA/
Status: success
Last contacted: 2026-09-14T06:42:24+00:00
Last successful contact: 2026-09-14T06:42:24+00:00

partim · September 14, 2026, 1:35pm

Everything looks good and should be working.

Can you double-check that you set up serving of RRDP correctly? I.e., that whatever is served at https://rpkica01.local/rrdp/ is what Krill actually produces?

mk0294 · September 14, 2026, 2:08pm

Hopefully this is what you need

root@rpkica0101:/var/lib/krill/data/repo/rrdp# ls -l
total 8
drwxr-xr-x 5 krill krill 4096 Sep 14 09:30 ed790d95-46f3-440e-a3be-a7435fe6771a
-rw-r–r-- 1 krill krill 988 Sep 14 09:30 notification.xml

root@rpkica0101:/var/lib/krill/data/repo/rrdp# cat notification.xml

root@rpkica0101:/var/lib/krill/data/repo/rrdp/ed790d95-46f3-440e-a3be-a7435fe6771a# ls -l
total 12
drwxr-xr-x 4 krill krill 4096 Sep 12 23:34 167
drwxr-xr-x 4 krill krill 4096 Sep 13 16:54 168
drwxr-xr-x 4 krill krill 4096 Sep 14 09:30 169

root@rpkica0101:/var/lib/krill/data/repo/rrdp/ed790d95-46f3-440e-a3be-a7435fe6771a/169# ls -l
total 8
drwxr-xr-x 2 krill krill 4096 Sep 14 09:30 16c3250d8d5a8c8e
drwxr-xr-x 2 krill krill 4096 Sep 14 09:30 4b3bde18e79078a0

root@rpkica0101:/var/lib/krill/data/repo/rrdp/ed790d95-46f3-440e-a3be-a7435fe6771a/169/16c3250d8d5a8c8e# ls -l
total 12
-rw-r–r-- 1 krill krill 11338 Sep 14 09:30 snapshot.xml

root@rpkica0101:/var/lib/krill/data/repo/rrdp/ed790d95-46f3-440e-a3be-a7435fe6771a/169/4b3bde18e79078a0# ls -l
total 4
-rw-r–r-- 1 krill krill 3903 Sep 14 09:30 delta.xml

root@rpkica0101:/var/lib/krill/data/repo/rrdp/ed790d95-46f3-440e-a3be-a7435fe6771a/169/4b3bde18e79078a0# cat delta.xml

MIIH0gYJKoZIhvcNAQcCoIIHwzCCB78CAQMxDTALBglghkgBZQMEAgEwgfAGCyqGSIb3DQEJEAEaoIHgBIHdMIHaAgIAqBgPMjAyNjA5MTQxMzI1MDJaGA8yMDI2MDkxNTEzNDkwMloGCWCGSAFlAwQCATCBpjBRFiw1RTZGN0YyRTkzMzU0Nzk4MTQ4NDRDQzdCRjNBMDc4N0U3MDdEODg2LmNybAMhAD2kkyivZCrGd3iT4FOTlg6g8qjYbUgM6Bi1WmUxYMR2MFEWLDQ3MEU5NURGMkEwOEZBODQwRDI5Q0Q1MEZCRDJDMzNBMTQ3ODAwOTguY2VyAyEAIsklgqvT4O7gCEIf/PP3BYRtWerKzJb2M5xp9UQnHJqgggUIMIIFBDCCA+ygAwIBAgIUTyyTBHHhXIJEFClpjgdryRAAyRwwDQYJKoZIhvcNAQELBQAwMzExMC8GA1UEAxMoNUU2RjdGMkU5MzM1NDc5ODE0ODQ0Q0M3QkYzQTA3ODdFNzA3RDg4NjAeFw0yNjA5MTQxMzI1MDJaFw0yNjA5MTUxMzQ5MDJaMDMxMTAvBgNVBAMTKDE4Qzg1MzVFOEEwQkVFNTZFNTgxNDJBNTNFMkNCOEZERjRBQjY3NzYwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC/tTFq+s8lLBc6DkZv9iRyXq/zBQnF788hHz3jDS82QekDv9FHodv3uZS4cFZEHa+tP7RZlkwTCO8grdFmaf/8neAfynXUvQJTznI8FABivIH1A/93c4b/XvkwGOIFvlLNPUovCyy5flOC1DJRoj53qd0YOkHjP2K6HMzkb1hky/mj3cmMjVYqsEUIiEcIgFuLrQSTopg3B8ZaCjoHIvJhPOZ4wjYYSMhCHEYqmoxnlxrA6+X8Spr/5+p1a0UwoL0Lea1Ri69lwWz0H4ti+Prpmwwp2xK0YVpyC5WtaeSZe1Ia7XipoKiyatqrcqOCnXl+hPN7gU3jf0IsJWqbFpF5AgMBAAGjggIOMIICCjAdBgNVHQ4EFgQUGMhTXooL7lblgUKlPiy4/fSrZ3YwHwYDVR0jBBgwFoAUXm9/LpM1R5gUhEzHvzoHh+cH2IYwDgYDVR0PAQH/BAQDAgeAMHEGA1UdHwRqMGgwZqBkoGKGYHJzeW5jOi8vcnBraWNhMDEuc3ZjLmtpZWZmZXJmYW1pbHkuY2EvcmVwby9vbmxpbmUvMC81RTZGN0YyRTkzMzU0Nzk4MTQ4NDRDQzdCRjNBMDc4N0U3MDdEODg2LmNybDBzBggrBgEFBQcBAQRnMGUwYwYIKwYBBQUHMAKGV3JzeW5jOi8vcnBraWNhMDEuc3ZjLmtpZWZmZXJmYW1pbHkuY2EvcmVwby81RTZGN0YyRTkzMzU0Nzk4MTQ4NDRDQzdCRjNBMDc4N0U3MDdEODg2LmNlcjB8BggrBgEFBQcBCwRwMG4wbAYIKwYBBQUHMAuGYHJzeW5jOi8vcnBraWNhMDEuc3ZjLmtpZWZmZXJmYW1pbHkuY2EvcmVwby9vbmxpbmUvMC81RTZGN0YyRTkzMzU0Nzk4MTQ4NDRDQzdCRjNBMDc4N0U3MDdEODg2Lm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQH/BBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEAe2FIGeGFKnkYTRtTramVDKSIpu6HsMmUm1oz61fPq1gVI3yW1I6I0FxdC9I4GMdf+QOVam1L/bSt40m9hsDYRuQm8wYV2MrDUbtelEjzJwrF9LqVFr3F08hLsLC5eJonPuRypGECndeovUFaNgX+0yfZbnyPO2PTfY+nsAWypzfawPjWqUNnrriYb/nbj9wN56qgFhes28JKervmWD/6UMdG/vEsVfeC4VQmPMyeDFyEvZmtJVrRHaYIohYINXAlvmGlwRE/Ig86PD4ZfDMTUlalwXr901rj86O1ZAv4fOs/CjnBdIXZBnqrnyqJpbcupih36nbPtDuqunRdgeX+qzGCAaowggGmAgEDgBQYyFNeigvuVuWBQqU+LLj99KtndjALBglghkgBZQMEAgGgazAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTI2MDkxNDEzMzAwMlowLwYJKoZIhvcNAQkEMSIEICala9+lLtYxbv1frrsIexRUmQx/p1roFFP6Z+rKQRraMA0GCSqGSIb3DQEBAQUABIIBAERHCTjSkdLyw3XE3GuHN9WGMgeBVLLxzU/qoIlBN7NzmkMPQzWo5e/olatLNrkKOqG3dgW20nMKirymrzILY1DgXFQt9i5ph2BVVeyGMZWyONwKY6fyx+oa87mzH3o5VkQsQVmnHoLg8VynmUXuHihDRbAJiFEM2uYRtCGvHBm+uEUz63HAA4xZbwqOBFTwMv9Cen4trn2hsqTsFywJX9GhOeM6lC9xPEqw2mmsnLCCGOHKuLZG2SZAYs6REmDlsAkPsgun/TPUaPaIAqekpK3CIulYV7iubaa2aqJjrpTwxpNlrBf9P3cToAL787V/xlfyyo7bkNHEywnbl+PPLzA=

MIIB/jCB5wIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyg1RTZGN0YyRTkzMzU0Nzk4MTQ4NDRDQzdCRjNBMDc4N0U3MDdEODg2Fw0yNjA5MTQxMzI1MDJaFw0yNjA5MTUxMzQ5MDJaME4wJQIUeRQtgQRqy/3S8eqd2Mjs8paYul0XDTI2MDUwOTAzNDE0M1owJQIUBRu82gOy0580cN39B+21ZlGaGikXDTI2MDUxMDAyMzk1NlqgMDAuMB8GA1UdIwQYMBaAFF5vfy6TNUeYFIRMx786B4fnB9iGMAsGA1UdFAQEAgIAqDANBgkqhkiG9w0BAQsFAAOCAQEAeTf/NERlV3N6n9mRlFY64MKMtFYg+dFf36yfIbQyfpkj7vt81e7aPxvn4Z2Y7E7uvjodi59PIIogdoEEzneRsudEYdBjuKyobMAhsqAQHV0S+z09FKO9rzv1u5X6qVJWIR6YMWsGo+2HAOLIzSVJIGEUew+RSpePhC2xYFk5zq/gps56ijteUCwr6w9lyzfcFnkrWMwRbSuHN3jUpu7cWjhUKMdoqK0Hup9wJUZnqc17LX/UE6LzjWfmU96ftLke6RmdzQSqPu21aUo0wom7Q3VT3g65xZ5aQY9uTEsVrLYvgFsjxhb1EWVkPt5wNlAbk7eQkRZe+29Lg6MMNfRtqQ==

root@rpkica0101:/var/lib/krill/data/repo/rrdp/ed790d95-46f3-440e-a3be-a7435fe6771a/169/16c3250d8d5a8c8e# cat snapshot.xml

MIIBrTCBlgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygzNkU3OENEMTk0Q0UzRjEzOUEzQ0Y2Qzg3NDQ3MjkyNTA4Q0YwNTMwFw0yNjA1MDYwMjIyMjdaFw0yNjA3MjkwMjI3MjdaoC8wLTAfBgNVHSMEGDgBQ254zRlM4/E5o89sh0RyklCM8FMDAKBgNVHRQEAwIBAjANBgkqhkiG9w0BAQsFAAOCAQEABXYQtX3OJyUVMCQbBiLcixdMHhhVX4DnndKBHrYVtY+yNEPbJ7+XgaaXtaJunLVZhtF/DBeIvJp4KEGmq2ckxqZCmAgMtg3+yfMOwFD4McJym9NvX2kcIWlITpWmwt6K6JqAHda1wf5JM6G4Mr5ozJ75+jxwT5hFsVW4QfMzrd5/y6U7JKxT+ACUuvvCnr+I0OCqoM8YNZ27H32cN9I/4MQ2gFdhA+zlQ9IPozWTBzx5drgj+MVJDOGYL4N6FC9yWz2/j58zV+j0QqGswUHCq/NLLeplcO2D4EYNlLGH8GGpl/+Ncr/UcO6aREfFUqFOjBMJTXdMwUnrxGsb/Q==

MIIFhTCCBG2gAwIBAgIUFGOQ/rL06iE5B6XrJk17SUvQ9kUwDQYJKoZIhvcNAQELBQAwMzExMC8GA1UEAxMoMzZFNzhDRDE5NENFM0YxMzlBM0NGNkM4NzQ0NzI5MjUwOENGMDUzMDAeFw0yNjA1MDYwMjIyMjdaFwNzA1MDUwMjI3MjdaMDMxMTAvBgNVBAMTKDVFNkY3RjJFOTMzNTQ3OTgxNDg0NENDN0JGM0EwNzg3RTcwN0Q4ODYwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCzebvukazCI/ao2dcHeSz8QI08L9LEw/1w67oSjgLEKBBZGq2J7YRWoaAYjgyc6eTgtSLGQCDFw29jybBw6G75iPCrSv3A3Gn6Wr+uFFsibhbops3Q3VnLPpbzznEbPwi3mC1gSpU61OJWYfN/Djipmp92naMaQ4mn+34vVmt4V3+WIQNi5pMW93o+yx8XMe1q4l14k6bv2MGXVm1qKJEb0k0ZzXq2HHrz1xkjOON8dyBe6vTYSF2TGo5R8aZdTxuSkD+f4iIzavDKOeGjeyPmJRc0Ara0ePCwbQnPAiDYRlCNu4pxdkudyGrPUf12HpOspb1F7B7R2NDd9xehAgMBAAGjggKPMIICizAPBgNVHRMBAfBTADAQH/MB0GA1UdDgQWBBReb38ukzVHmBSETMe/OgeH5wfYhjAfBgNVHSMEGDAWgBQ254zRlM4/E5o89sh0RyklCM8FMDAOBgNVHQ8BAf8EBAMCAQYwaAYDVR0fBGEwXzBdoFugWYZXcnN5bmM6Ly9ycGtpY2EwMS5zdma2llZmZlcmZhbWlseS5jYS9yZXBvLzM2RTc4Q0QxOTRDRTNGMTM5QTNDRjZDODc0NDcyOTI1MDhDRjA1MzAuY3JsMEsGCCsGAQUFBwEBBD8wPTA7BggrBgEFBQcwAoYvcnN5bmM6Ly9ycGtpY2EwMS5zdmMua2llZmZlcmbWlseS5jYS90YS90YS5jZXIwggEJBggrBgEFBQcBCwSB/DCB+TBABggrBgEFBQcwBYY0cnN5bmM6Ly9ycGtpY2EwMS5zdmMua2llZmZlcmZhbWlseS5jYS9yZXBvL29ubGluZS8wLzBsBggrBgEFBQcwCoZgcnN5bmM6LycGtpY2EwMS5zdmMua2llZmZlcmZhbWlseS5jYS9yZXBvL29ubGluZS8wLzVFNkY3RjJFOTMzNTQ3OTgxNDg0NENDN0JGM0EwNzg3RTcwN0Q4ODYubWZ0MEcGCCsGAQUFBzANhjtodHRwczovL3Jwa2ljYTAxLnN2Yy5raWZmVyZmFtaWx5LmNhL3JyZHAvbm90aWZpY2F0aW9uLnhtbDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCcGCCsGAQUFBwEHAQH/BBgwFjAJBAIAATADAwEAMAkEAgACMAMDAQAwIQYIKwYBBQUHAQgBAf8EEjAQoA4wDDAgEAAgUA/////zANBgkqhkiG9w0BAQsFAAOCAQEATeJwmWVinaGD9JpoBwAzkpxzzC+dn7J8x7V01edXavkmefZNVni+3FDpdpvQ92L+b/B/XxnvS4pwJ2zdN44xgMA1N9uus35J0woVn/u7mQl5ZCD1uP8IvDh7u9JOBXHlcYHFbX+idU5/on/I3Y1cpMd7N/dnSILeW3zRcL58lh+jQzmX+S4yFuN+iHD8+LkSU3AzNHDXwqgc9Yg6IhMisMCsqhIyjyoaWyJefc4zk4i1ZiFBFFySWY6q478Ljk8k9Rb2GkhLIQPPU02CRKXJ0VVDxUlJTvehi/JazsCqrzaiyzxMg6dgVFz6wAQhdL3Gu+ZHJ/2JxUmCsw7CiQ==

MIIHlwYJKoZIhvcNAQcCoIIHiDCCB4QCAQMxDTALBglghkgBZQMEAgEwge8GCyqGSIb3DQEJEAEaoIHfBIHcMIHZAgECGA8yMDI2MDUwNjAyMjIyN1oYDzIwMjYwNzI5MDIyNzI3WgYJYIZIAWUDBAIBMIGmMFEWLDRTc4Q0QxOTRDRTNGMTM5QTNDRjZDODc0NDcyOTI1MDhDRjA1MzAuY3JsAyEA6FT3V3/piGAfWofFu6ABZR/fJmjtbVzvDvUOKdYuLQ4wURYsNUU2RjdGMkU5MzM1NDc5ODE0ODQ0Q0M3QkYzQTA3ODdFNzA3RDg4Ni5jZXIQBtSZUV6bBGikjNy/HmCTdwk57WTGurwGspR9ZhdbPzMqCCBM4wggTKMIIDsqADAgECAhRVRWvWFGWu1bLTGDVdM3ayEOC/GjANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygzNkU3OENEMTk0Q0UzRjEzOUEzQ0Y2QzNDQ3MjkyNTA4Q0YwNTMwMB4XDTI2MDUwNjAyMjIyN1oXDTI2MDcyOTAyMjcyN1owMzExMC8GA1UEAxMoOTI4N0I1QkQxRjQ4NEI2Q0I0NDI4RDlFNzZDREY2MjlBRDYwMTY0OTCCASIwDQYJKoZIhvcNAQEBBQADggEPADAQoCggEBAMhMJm629eBWbgBFtT63aulC63hZWu2zCgVhcTyn7+wrpud9CXanBzhyHyzHbLXGxak9ZThSl/+6uNizzjHGG9KdULWtUPM5BLJA4uLWOJrK9wlyFJS3gpx9drAsTT/xyGFbQ5y8SC9Gbg+Fz2S25ZXyo0MFyH1ieGwt8FlB7Zk3x2qoVk8HZEiLOJdEXbJ16n3zE6Bo2QmjFIlEF8Vcx+VpORmCEPMm2DUZpZ9D4n/PG2h/iLdzR0ysCpxWTHg8TwXYqpiIpTUxJSujJDP1fVCtlNvy5DxzJoi1cYcrz1Kqj9LjAjTvhPG5FVgSP8qXXdoIyzMHB73GAozMjX0CAwEAAaOCAdQwggHQMB0GA1UdDgQWBBSSh7W9H0hLbLRCjZ52zfYprWAWSTAfBgNVHSMEGDAWgBQ254zRlM4/E5o89sh0RyklCM8FMDAOBgNVHQ8BAf8EBAMCB4AwaAYDVR0fBGEwXzBdoFugWYZXcnbmM6Ly9ycGtpY2EwMS5zdmMua2llZmZlcmZhbWlseS5jYS9yZXBvLzM2RTc4Q0QxOTRDRTNGMTM5QTNDRjZDODc0NDcyOTI1MDhDRjA1MzAuY3JsMEsGCCsGAQUFBwEBBD8wPTA7BggrBgEFBQcwAoYvcnN5bmM6Ly9ycGY2EwMS5zdmMua2llZmZlcmZhbWlseS5jYS90YS90YS5jZXIwcwYIKwYBBQUHAQsEZzBlMGMGCCsGAQUFBzALhldyc3luYzovL3Jwa2ljYTAxLnN2Yy5raWVmZmVyZmFtaWx5LmNhL3JlcG8vMzZFNzhDRDE5NENFM0YxMzM0NGNkM4NzQ0NzI5MjUwOENGMDUzMC5tZnQwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjAhBggrBgEFBQcBBwEB/wQSMBAwBgQCAAEFADAGBAIAAgUAMBUGCCsGAQUFBwEIAQH/BAYwBKACBQAwDQYJKoZIhvcNAQELBQggEBABlX4GSnvxb6yElSpg0XmAFOo2urtxbDhaYiw00E1dVTT84XLKxcDvtcqzanLiV23PcTuf96sTq16zoLIs3VaWnLquZCTWGh7VDjaYxG3yDyX1U6zZx9g2N9b20j3SlPoZvqVSLbCKzIEiFzOdhDIIs1oKJClhXefgRrP3En18F/aCkXdX/M8FOuGYF0zrb7uBumWFwN4I8wAoiEenlMDYv/D3xcutITDJXigdRDV54Ld+d21xdcuzFkgJ3EW4xFqqL1GRIf+2pGS+02rKy34HOvWfDu/MvX0WFrMHmwnVsIfuBn4dzvaYA2PRP9J2wl699qU1NH3UNb/4Qkg80xggGqMIIBpgIBA4AUkoe1vR9IS2y0Qo2eds32Ka1gFkkwCwYJYIZIAWUDBAIBoGswGgYJKoZIhvcNAQkDMQ0GCyqGSIb3DQEJEAEaMBwGCSqGSIb3DQEJBTEPFw0yNjA1MDYwMjI3MjdaMC8GCSqGSIb3DQBDEiBCDaheSNdTC8T2A36m5P5haPFYH6l8M9NQnejEGaDpXm4TANBgkqhkiG9w0BAQEFAASCAQC5Gr8ebMfs3Q6+nqjuyj7izT5lKk1/gwXM/5yBizuc9WH3YrHxdHhdxelqSoaYjAIbofmTSnRLUNLO5w+NY/w1835EAztnQFN4tJdMvvUeQs3b/VeddYjJwj2BhwrvfzxO+YXVITXmC+4QlmI2XDA4IVJs+o/xEOeTm0DjQrlePye+12MxNBS1xkqWtVtuvCtikJT0CxwBg0Nx6WJLJSIXgFEbjjcGpF4f4MB9oGtL3ELrBh+oYHDR+28AxkrP5cM7gIrhV/FKcpUfkidBPew/4pn7t14R64SY78wDl4kCFLQ7yFQBye290G4iR/3H6M3qFcwD3xZJCBC35DSe

MIIH0gYJKoZIhvcNAQcCoIIHwzCCB78CAQMxDTALBglghkgBZQMEAgEwgfAGCyqGSIb3DQEJEAEaoIHgBIHdMIHaAgIAqBgPMjAyNjA5MTQxMzI1MDJaGA8yMDI2MDkxNTEzNDkwMloGCWCGSAFlAwQCATCBpjBRFiRTZGN0YyRTkzMzU0Nzk4MTQ4NDRDQzdCRjNBMDc4N0U3MDdEODg2LmNybAMhAD2kkyivZCrGd3iT4FOTlg6g8qjYbUgM6Bi1WmUxYMR2MFEWLDQ3MEU5NURGMkEwOEZBODQwRDI5Q0Q1MEZCRDJDMzNBMTQ3ODAwOTguY2AyEAIsklgqvT4O7gCEIf/PP3BYRtWerKzJb2M5xp9UQnHJqgggUIMIIFBDCCA+ygAwIBAgIUTyyTBHHhXIJEFClpjgdryRAAyRwwDQYJKoZIhvcNAQELBQAwMzExMC8GA1UEAxMoNUU2RjdGMkU5MzM1NDc5ODE0ODQ0Q0QkYzQTA3ODdFNzA3RDg4NjAeFw0yNjA5MTQxMzI1MDJaFw0yNjA5MTUxMzQ5MDJaMDMxMTAvBgNVBAMTKDE4Qzg1MzVFOEEwQkVFNTZFNTgxNDJBNTNFMkNCOEZERjRBQjY3NzYwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwggEKAoIBAQC/tTFq+s8lLBc6DkZv9iRyXq/zBQnF788hHz3jDS82QekDv9FHodv3uZS4cFZEHa+tP7RZlkwTCO8grdFmaf/8neAfynXUvQJTznI8FABivIH1A/93c4b/XvkwGOIFvlLNPUovCyy5flOC1DJRoj53qd0YOkP2K6HMzkb1hky/mj3cmMjVYqsEUIiEcIgFuLrQSTopg3B8ZaCjoHIvJhPOZ4wjYYSMhCHEYqmoxnlxrA6+X8Spr/5+p1a0UwoL0Lea1Ri69lwWz0H4ti+Prpmwwp2xK0YVpyC5WtaeSZe1Ia7XipoKiyatqrcqOCnXl+hPgU3jf0IsJWqbFpF5AgMBAAGjggIOMIICCjAdBgNVHQ4EFgQUGMhTXooL7lblgUKlPiy4/fSrZ3YwHwYDVR0jBBgwFoAUXm9/LpM1R5gUhEzHvzoHh+cH2IYwDgYDVR0PAQH/BAQDAgeAMHEGA1UdHwRqMGgwZqBkoGKGYHeW5jOi8vcnBraWNhMDEuc3ZjLmtpZWZmZXJmYW1pbHkuY2EvcmVwby9vbmxpbmUvMC81RTZGN0YyRTkzMzU0Nzk4MTQ4NDRDQzdCRjNBMDc4N0U3MDdEODg2LmNybDBzBggrBgEFBQcBAQRnMGUwYwYIKwYBBQUHMAKGV3eW5jOi8vcnBraWNhMDEuc3ZjLmtpZWZmZXJmYW1pbHkuY2EvcmVwby81RTZGN0YyRTkzMzU0Nzk4MTQ4NDRDQzdCRjNBMDc4N0U3MDdEODg2LmNlcjB8BggrBgEFBQcBCwRwMG4wbAYIKwYBBQUHMAuGYHJzeW5jOi8vcnaWNhMDEuc3ZjLmtpZWZmZXJmYW1pbHkuY2EvcmVwby9vbmxpbmUvMC81RTZGN0YyRTkzMzU0Nzk4MTQ4NDRDQzdCRjNBMDc4N0U3MDdEODg2Lm1mdDAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCEGCCsGAQUFBwEHAQBBIwEDAGBAIAAQUAMAYEAgACBQAwFQYIKwYBBQUHAQgBAf8EBjAEoAIFADANBgkqhkiG9w0BAQsFAAOCAQEAe2FIGeGFKnkYTRtTramVDKSIpu6HsMmUm1oz61fPq1gVI3yW1I6I0FxdC9I4GMdf+QOVam1L/bSt40m9hsRuQm8wYV2MrDUbtelEjzJwrF9LqVFr3F08hLsLC5eJonPuRypGECndeovUFaNgX+0yfZbnyPO2PTfY+nsAWypzfawPjWqUNnrriYb/nbj9wN56qgFhes28JKervmWD/6UMdG/vEsVfeC4VQmPMyeDFyEvZmtJVrRHaYIohNXAlvmGlwRE/Ig86PD4ZfDMTUlalwXr901rj86O1ZAv4fOs/CjnBdIXZBnqrnyqJpbcupih36nbPtDuqunRdgeX+qzGCAaowggGmAgEDgBQYyFNeigvuVuWBQqU+LLj99KtndjALBglghkgBZQMEAgGgazAaBgkqhkiG9wCQMxDQYLKoZIhvcNAQkQARowHAYJKoZIhvcNAQkFMQ8XDTI2MDkxNDEzMzAwMlowLwYJKoZIhvcNAQkEMSIEICala9+lLtYxbv1frrsIexRUmQx/p1roFFP6Z+rKQRraMA0GCSqGSIb3DQEBAQUABIIBAERHCTjSkdLyw33GuHN9WGMgeBVLLxzU/qoIlBN7NzmkMPQzWo5e/olatLNrkKOqG3dgW20nMKirymrzILY1DgXFQt9i5ph2BVVeyGMZWyONwKY6fyx+oa87mzH3o5VkQsQVmnHoLg8VynmUXuHihDRbAJiFEM2uYRtCGvHBm+uEUz63HAA4bwqOBFTwMv9Cen4trn2hsqTsFywJX9GhOeM6lC9xPEqw2mmsnLCCGOHKuLZG2SZAYs6REmDlsAkPsgun/TPUaPaIAqekpK3CIulYV7iubaa2aqJjrpTwxpNlrBf9P3cToAL787V/xlfyyo7bkNHEywnbl+PPLzA=

MIIF2DCCBMCgAwIBAgIUDMAc8hq3S6q5yNVk/m4uGy+pAU4wDQYJKoZIhvcNAQELBQAwMzExMC8GA1UEAxMoNUU2RjdGMkU5MzM1NDc5ODE0ODQ0Q0M3QkYzQTA3ODdFNzA3RDg4NjAeFw0yNjA1MDkwMzM4NTdaFwNzA1MDgwMzQzNTdaMDMxMTAvBgNVBAMTKDQ3MEU5NURGMkEwOEZBODQwRDI5Q0Q1MEZCRDJDMzNBMTQ3ODAwOTgwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDPNQMdQSkk4Dh1ZfmpDuF1CYR7XSLEcvI/7cc/QG0dy1knjA2yFCbunkVHU1BLbrLYY9KmsBMuhfcMyPIxMyFRF22RV7rA+la06H5ka9bVUnw9C/UcK1obWdC1mqqw9y4ZOkvGQFMNhPogr7ewkQwIAfu0A6wgRuJsEdwUF+EvmG/9LrVKesOisDoxFovn+Atv18CIREEYSA1GX+QSLcRxv3MoK3oUU6AoH2K1o+UPk88GU02hIKHWedoErF83TAueBbOZe67dmpXVs+FDVSyqLktj7phIan64nsoGNlkZxcdKlu3zmIKffj82wAuBYM6qxx1WW/UTzho+udD5AgMBAAGjggLiMIIC3jAPBgNVHRMBAfBTADAQH/MB0GA1UdDgQWBBRHDpXfKgj6hA0pzVD70sM6FHgAmDAfBgNVHSMEGDAWgBReb38ukzVHmBSETMe/OgeH5wfYhjAOBgNVHQ8BAf8EBAMCAQYwcQYDVR0fBGowaDBmoGSgYoZgcnN5bmM6Ly9ycGtpY2EwMS5zdma2llZmZlcmZhbWlseS5jYS9yZXBvL29ubGluZS8wLzVFNkY3RjJFOTMzNTQ3OTgxNDg0NENDN0JGM0EwNzg3RTcwN0Q4ODYuY3JsMHMGCCsGAQUFBwEBBGcwZTBjBggrBgEFBQcwAoZXcnN5bmM6Ly9ycGtpY2EwMS5zdma2llZmZlcmZhbWlseS5jYS9yZXBvLzVFNkY3RjJFOTMzNTQ3OTgxNDg0NENDN0JGM0EwNzg3RTcwN0Q4ODYuY2VyMIIBKwYIKwYBBQUHAQsEggEdMIIBGTBPBggrBgEFBQcwBYZDcnN5bmM6Ly9ycGtpcmVwbzAxLnN2YyaWVmZmVyZmFtaWx5LmNhL3JlcG8vS2llZmZlckZhbWlseVJQS0lDQS8wLzB7BggrBgEFBQcwCoZvcnN5bmM6Ly9ycGtpcmVwbzAxLnN2Yy5raWVmZmVyZmFtaWx5LmNhL3JlcG8vS2llZmZlckZhbWlseVJQS0lDQS8wLzMEU5NURGMkEwOEZBODQwRDI5Q0Q1MEZCRDJDMzNBMTQ3ODAwOTgubWZ0MEkGCCsGAQUFBzANhj1odHRwczovL3Jwa2lyZXBvMDEuc3ZjLmtpZWZmZXJmYW1pbHkuY2EvcnJkcC9ub3RpZmljYXRpb24ueG1sMBgGA1UdIA/wQOMAwwCgYIKwYBBQUHDgIwJwYIKwYBBQUHAQcBAf8EGDAWMBQEAgABMA4DAgAKAwMErBADAwDAqDAhBggrBgEFBQcBCAEB/wQSMBCgDjAMMAoCAwD8AAIDAP/+MA0GCSqGSIb3DQEBCwUAA4IBAQBPotq3NlIIC/9/j0U1VQhJhTeHxr+gSOsUe8FEcMoPubn7vIvcD8hrV7bqyiDqbftZ+bwGWyvJ8lR2TCvH2dYL3gb4Zhsryn4k247NP7PWexvBkmMe7ovS77/60YQJkEfBLzqFczIeusNjV2XFWp64alA/4CtLLlpmS3pI9EY13h+D8kRg/z+9SseJKaY4Tl1VvuFU2mBQdi8fkSRDhE48qmvT01gf0/JGX+C684qYp7BWUEEoojrUHDBa110TTt7+igDI6eqqVV5WeMq88JjVb57Y4LVvo2FoN5eT6mYNohcfOFMea0dJvUk2mwmCSocwIoVe8c0aRwXuB6GC

MIIB/jCB5wIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyg1RTZGN0YyRTkzMzU0Nzk4MTQ4NDRDQzdCRjNBMDc4N0U3MDdEODg2Fw0yNjA5MTQxMzI1MDJaFw0yNjA5MTUxMzQ5MDJaME4wJQIUeRQtgQRqy/8eqd2Mjs8paYul0XDTI2MDUwOTAzNDE0M1owJQIUBRu82gOy0580cN39B+21ZlGaGikXDTI2MDUxMDAyMzk1NlqgMDAuMB8GA1UdIwQYMBaAFF5vfy6TNUeYFIRMx786B4fnB9iGMAsGA1UdFAQEAgIAqDANBgkqhkiG9wAQsFAAOCAQEAeTf/NERlV3N6n9mRlFY64MKMtFYg+dFf36yfIbQyfpkj7vt81e7aPxvn4Z2Y7E7uvjodi59PIIogdoEEzneRsudEYdBjuKyobMAhsqAQHV0S+z09FKO9rzv1u5X6qVJWIR6YMWsGo+2HAOLIzSVJIGEUewSpePhC2xYFk5zq/gps56ijteUCwr6w9lyzfcFnkrWMwRbSuHN3jUpu7cWjhUKMdoqK0Hup9wJUZnqc17LX/UE6LzjWfmU96ftLke6RmdzQSqPu21aUo0wom7Q3VT3g65xZ5aQY9uTEsVrLYvgFsjxhb1EWVkPt5wNlAbk7kRZe+29Lg6MMNfRtqQ==

root@rpkica0101:/var/lib/krill/data/repo/rsync/current# ls -l
total 16
-rw-r–r-- 1 krill krill 433 Sep 14 09:30 36E78CD194CE3F139A3CF6C87447292508CF0530.crl
-rw-r–r-- 1 krill krill 1947 Sep 14 09:30 36E78CD194CE3F139A3CF6C87447292508CF0530.mft
-rw-r–r-- 1 krill krill 1417 Sep 14 09:30 5E6F7F2E9335479814844CC7BF3A0787E707D886.cer
drwxr-xr-x 3 krill krill 4096 Sep 14 09:30 online

root@rpkica0101:/var/lib/krill/data/repo/rsync/current/online/0# ls -l
total 12
-rw-r–r-- 1 krill krill 1500 Sep 14 09:30 470E95DF2A08FA840D29CD50FBD2C33A14780098.cer
-rw-r–r-- 1 krill krill 514 Sep 14 09:30 5E6F7F2E9335479814844CC7BF3A0787E707D886.crl
-rw-r–r-- 1 krill krill 2006 Sep 14 09:30 5E6F7F2E9335479814844CC7BF3A0787E707D886.mft

mk0294 · September 16, 2026, 11:52am

I did some more digging around, it appears that the signer needs to be updated?

Next Update: 2026-07-29

rpkita0101:/home# krillta signer exchanges

  Session number:    1
  Session date:      2026-05-06T02:27:28+00:00
  Plan next before:  2026-07-29T02:27:27+00:00

=================================================================

response | key identifier | child

issued | 5E6F7F2E9335479814844CC7BF3A0787E707D886 | online

rsync://rpkica01.local/repo/36E78CD194CE3F139A3CF6C87447292508CF0530.mft
rsync://rpkica01.local/repo/36E78CD194CE3F139A3CF6C87447292508CF0530.crl
rsync://rpkica01.local/repo/5E6F7F2E9335479814844CC7BF3A0787E707D886.cer

rpkita0101:~$ sudo krillta signer show

 ID Certificate

 Trust Anchor Objects

Revision: 2
Next Update: 2026-07-29T02:27:27.318490194+00:00

Objects:
rsync://rpkica01.local/repo/36E78CD194CE3F139A3CF6C87447292508CF0530.mft
(5803d302cfd9b62cccd60155d01e3efa3a8c15f2b012d6533307c896a36f4bbb)
rsync://rpkica01.local/repo/36E78CD194CE3F139A3CF6C87447292508CF0530.crl
(e854f7577fe988601f5a87c5bba001651fdf2668ed6d5cef0ef50e29d62e2d0e)
rsync://rpkica01.local/repo/5E6F7F2E9335479814844CC7BF3A0787E707D886.cer
(6d499515e9b0468a48cdcbf1e6093770939ed64c6babc06b2947d66175b3f332)

TAL

Https ://rpkica01.local/ta/ta.cer

rsync://rpkica01.local/ta/ta.cer

MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApZ+WC2FDFA22m1A88ucK
kkGUfVOaUN350clHg9tAs/yMY6HFMLcGDAoeNtEK0elgpcmevu9sB23PfbRjxCQW
CflqmpsER80+TBM6Zmbdr0lQcP42vfiiOanf3xGfdjQCASJq97aPpaDmZCoMnWpy
Wt6sWp/gFT43sPAIIsIWoQL/puw2A91V0Z0RSPQiA4TWg0Xms+EblDg4678CojwL
HSegH3hG4kDuBRJZm78EQgSnUwljChxfdWGJm6lrQn5JGcYNHceVhbExYtiY3FOM
nZqlrHDIxw/r9fUz5C8TdaynEf/tpuoSVBYovoGobjyy1zFVbQs8vMb97+p+XuqQ
YwIDAQAB

mk0294 · September 18, 2026, 11:43pm

So this was the issue. I was able to resolve this by renewing the signer by following these steps. Krill as a Trust Anchor — Krill 0.17.0-dev documentation

The expiry just happened to coincide when the CA was powered down for a week. Thanks @Koen @partim for responding.

Koen · September 21, 2026, 10:20am

That explains a lot and is indeed an unfortunate coincidence