rpki-client man page

rpki-client — produce valid route announcements


rpki-client[-fnqrv] [-e rsync_prog] tal ...


The rpki-client utility produces all route announcements starting with trust anchor locators. It uses openrsync(1) to fetch certificates, manifests, revocation lists, and route announcements themselves. Its arguments are as follows:

-e rsync_prog

Use rsync_prog instead of openrsync(1) to fetch repositories. It must accept the -rlt and --delete flags and connect with rsync-protocol locations.


Accept out-of-date manifests. This will still report if a manifest has expired.


Assume that all requested repositories exist: don't update.


Don't emit any route statements.


Don't parse certificate revocation files. This additional step can take a long time.


Specified once, prints information about status. Twice, prints each filename as it's processed.


A trust anchor locator (TAL) file.

rpki-client produces a list of unique roa-set statements as specified by bgpd.conf(5) on standard output.

Exit Status

The rpki-client utility exits 0 on success, and >0 if an error occurs.

See Also

openrsync(1) bgpd.conf(5)


The following standards are used or referenced in rpki-client:

RFC 3370

Cryptographic Message Syntax (CMS) Algorithms.

RFC 3779

X.509 Extensions for IP Addresses and AS Identifiers.

RFC 4291

IP Version 6 Addressing Architecture.

RFC 4631

Classless Inter-domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan.

RFC 5280

Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile.

RFC 5652

Cryptographic Message Syntax (CMS).

RFC 5781

The rsync URI Scheme.

RFC 5952

A Recommendation for IPv6 Address Text Representation.

RFC 6480

An Infrastructure to Support Secure Internet Routing.

RFC 6482

A Profile for Route Origin Authorizations (ROAs).

RFC 6485

The Profile for Algorithms and Key Sizes for Use in the Resource Public Key Infrastructure (RPKI).

RFC 6486

Manifests for the Resource Public Key Infrastructure (RPKI).

RFC 6487

A Profile for X.509 PKIX Resource Certificates.

RFC 6488

Signed Object Template for the Resource Public Key Infrastructure (RPKI).

RFC 7730

Resource Public Key Infrastructure (RPKI) Trust Anchor Locator.


The rpki-client utility was written by Kristaps Dzonsons <kristaps@bsd.lv>.


August 31, 2019