What is TAL?

A TAL (Trust Anchor Locator) is a small file telling RPKI validators where to fetch a trust anchor's root certificate and which public key it must have.

RPKI is a chain of certificates: each RIR operates a root certificate, issues certificates to the holders of its address space, and those holders sign ROAs. Everything a validator accepts must chain back to a root it already trusts, so it needs a safe starting point. A TAL, in the format described in RFC 8630, provides one in a few lines of text: one or more URIs (rsync or HTTPS) where the current root certificate can be downloaded, followed by the public key that certificate must contain. The validator fetches the certificate, checks that its key matches the TAL, and only then walks down the tree. Publishing the key rather than the whole certificate lets the RIR reissue its root certificate, for example to renew it, without every validator needing a new TAL.

Validators such as Routinator, rpki-client and FORT are typically set up with the TALs of the five RIRs: AFRINIC, APNIC, ARIN, LACNIC and RIPE NCC. Some RIRs also publish separate TALs for AS0 ROAs covering unallocated space, which validators do not use by default, so adding one is a deliberate choice. A missing TAL quietly removes every ROA under that RIR, turning its routes from Valid or Invalid into NotFound, so it is worth confirming that all five load after installing or upgrading a validator. Because the TAL is the root of trust, obtain it from the validator's packaging or the RIR itself. See RPKI and RRDP; the RPKI and Route Origin Validation lesson explains the trust chain from TAL to ROA.