Krill RPKI Certificate Authority - Ready-to-Run AMI by cloudimg

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Krill is a Resource Public Key Infrastructure (RPKI) Certificate Authority that lets network operators run their own CA and publish Route Origin Authorizations (ROAs) for their IP prefixes. Networks worldwide can then cryptographically verify which autonomous system is authorized to originate a route, strengthening BGP security. This AMI delivers Krill 0.16.0 fully installed and serving over HTTPS within minutes of launch, with no manual compilation, no nginx configuration, and no systemd unit authoring required.

Buyers evaluating RPKI deployment typically consider three paths:

• Manual deployment from packages or source: requires installing Rust toolchains or distro packages, configuring nginx as a reverse proxy, generating TLS certificates, writing systemd units, and hardening credentials. This AMI eliminates all of that; the stack is production-ready on first boot.
• RIR-hosted RPKI portal: convenient but offers no local control, no API automation, and no ability to integrate ROA management into your own CI/CD or network automation pipelines. Krill gives you a REST API and CLI client for full scriptability.
• Building your own AMI: time-consuming to maintain, patch, and harden. cloudimg maintains this image with security updates and provides 24/7 support so you can focus on operating your network rather than packaging software.

Krill ships as a single set of Rust binaries (the krill daemon and the krillc CLI client) with an embedded data store, so there is no external database to deploy or manage. The daemon binds exclusively to the loopback interface. nginx is the sole network-facing surface: it terminates TLS on port 443 and reverse-proxies to the daemon. Port 80 redirects to HTTPS and answers an unauthenticated health probe for load-balancer checks. systemd starts both services on boot and restarts them on failure.

On the first boot of your instance, a one-shot systemd service generates a fresh admin token unique to that instance, regenerates the TLS certificate for that instance, and records the token in a file only the root user can read. No shared or default credential ships in the image. Anonymous and wrong-token API calls are rejected. Compare this to AMIs that ship with a published default password: this image has no credential to rotate because one is never shared.

Create one or more Certificate Authorities, request resources from a parent such as your Regional Internet Registry, and publish ROAs that state which autonomous system may originate each of your prefixes. Krill implements the standard RPKI provisioning and publication protocols and includes a built-in web UI as well as the krillc CLI, so you can operate everything from a browser or a script.

1. Launch the AMI and ensure your security group allows inbound TCP on ports 443 and 80.
2. SSH into the instance and retrieve the generated admin token from the root-only file.
3. Open the web UI in your browser over HTTPS, sign in with the token, and create your first CA.
4. Configure your parent CA (typically your RIR) and a publication server.
5. Publish your first ROA.

For production use, place a real domain and a CA-signed certificate in front of the instance.

• Run your own RPKI Certificate Authority to sign ROAs for the prefixes your network originates.
• Improve routing security by making your prefixes verifiable to networks performing Route Origin Validation.
• Operate a self-hosted, delegated RPKI CA under your own control with full API and CLI automation.
• Integrate ROA lifecycle management into existing network automation and CI/CD pipelines.

24/7 technical support by email and chat. Assistance covers deployment, HTTPS and custom domain setup, configuring a parent CA and publication server, creating and managing ROAs, and storage and upgrade planning.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.