Krill is an open-source Resource Public Key Infrastructure (RPKI) daemon that IPXO uses to manage and automate RPKI requests from all Regional Internet Registries (RIRs). 

Who is Krill for?

• Companies that own many subnets from different RIRs and wish to manage resources using one system
• Companies that wish to automate RPKI management using one UI or API
• Companies that want to sub-delegate resources to a different company (e.g., companies can employ IPXO to manage their RPKIs) 

How does Krill work? 

Krill works with two moving parts:

• CA (Certificate Authority) - responsible for the RPKI part
• Repository (publication server) - shows your Certificate and created ROAs globally

To serve the published content to Rsync and RRDP, IP holders must run repository servers using such tools as Rsyncd and NGINX. That is because the Repository publishes CA content via Rsync/RRDP clients to the internet. 

To learn more about the moving parts of Krill, please read the Before You Start guide produced by Krill.

Benefits of Krill for IP holders at IPXO

Here are the top reasons to use Krill if you are an IP holder at the IPXO Marketplace:

• Decreased number of RPKI requests 
• Fewer risks of receiving deductions for not completing an RPKI request within 48 hours 
• Quicker subnet provisioning: Subnets with the automated RPKI feature are more attractive to customers, which means subnets are leased more frequently and faster

Setup options

Option A: IPXO gains RPKI control of all ranges allocated to a particular organization 

1. IPXO creates the client's RPKI CA along with the Repository for the client's RPKI management and generates the child request XML file. 
2. IPXO provides the client with the child request XML file. 
3. The client indicates in the RIR's RPKI configuration that RPKI would be Delegated. 
4. The client adds the child request XML file to the RIR's RPKI configuration and receives the parent response XML file. 
5. The client provides IPXO with the parent response XML file. 
6. IPXO adds the parent response XML file to the client's RPKI CA server. The connection between the RIR and the CA server is established. 
7. OPTIONAL: The client is provided with access to Krill. All IPs are visible and managed by the client. 

Option B: IPXO gains RPKI control of specific ranges allocated to a particular organization 

1. The client creates RPKI CA along with the Repository for RPKI management and generates the child request XML file. 
2. The client indicates in the RIR's RPKI configuration that RPKI would be Delegated. 
3. The client adds a child request XML file to the RIR's RPKI configuration and receives a parent response XML file. 
4. The client adds the parent response XML file to the RPKI CA server on their infrastructure. The connection between RIR and the CA server on the client's infrastructure is established. 
5. IPXO creates the client's RPKI CA along with the Repository for the client's RPKI management on the IPXO infrastructure and generates the child request XML file. 
6. IPXO provides the client with the child request XML file. 
7. The client adds a child request XML file to the CA server on the client's infrastructure. 
8. The client configures in the CA server on their infrastructure which IP range RPKI is managed on IPXO's server and generates the parent response XML file.  
9. The client provides IPXO with the parent response XML file. 
10. IPXO adds the parent response XML file to the client's RPKI CA server on the IPXO infrastructure. The connection between CA on the client's infrastructure and the CA server on IPXO's infrastructure is established. 

Do you have questions?

Interested in using Krill and setting it up? Contact the IPXO Product Support team via help.ipxo.com or feedback widget, and we will provide you with all the necessary information. 

NOTE: Currently, the Krill setup is available only for APNIC, ARIN and RIPE NCC RIRs.