YD/T 4619-2023
BGPsec technical requirements Router certificate rotation (English Version)

Standard No.

YD/T 4619-2023

Language

Chinese, Available in English version

Release Date

2023

Published By

Professional Standard - Post and Telecommunication  CN  /  YD

Latest

YD/T 4619-2023

Introduction

BGPsec certificate rotation technical framework

According to the YD/T standard, the certificate rotation of BGPsec router must comply with the RFC8634 specification. Its core process includes:

Phase	Operation content	Time requirement
New certificate issuance	Generate key pair and publish it to RPKI repository	T+0
Segment period	Wait for global RPKI cache synchronization	≥24 hours
Key switch	Stop signing with old keys and refresh BGPsec UPDATE	Off-peak period

---

Four trigger conditions for key rotation

Typical case: An operator’s AS64500 completed emergency rotation within 2 hours due to key leakage detection:

1. Immediately generate a new key pair (ECDSA-256)
2. Automatically configure a new certificate through the EST protocol
3. Mark the old certificate serial number in the CRL

---

Replay attack defense mechanism

Time window control through key rotation:

• Minimum exposure window: 2×RPKI propagation time
• Optimization solution: Pre-setting dual certificates can shorten the window to 1 times the propagation time

---

Implementation Recommendations

Automated Deployment Requirements

It is recommended to use the EST protocol defined in RFC7030:

RouterConfig { "est_server": "rpkica.example.com", "rollover_interval": 90d, "emergency_threshold": 1h }

Multi-AS Collaboration Strategy

For a BGPsec spokesperson cluster across ASs, it is necessary to establish the following:

• JWT authentication mechanism for shared key pool
• Real-time revocation notification based on CRL

YD/T 4619-2023 Referenced Document

• RFC 8210 The Resource Public Key Infrastructure (RPKI) to Router Protocol@ Version 1

YD/T 4619-2023 history

• 2023 YD/T 4619-2023 BGPsec technical requirements Router certificate rotation

Standard and Specification