Route Origin Authorization

$ rpki-client -vvf repo-rpki.idnic.net/repo/19205e7c-a881-4873-9188-e521b6af529c/0/323430303a646330303a633030323a3a2f34382d3438203d3e20313331313131.roa
File:                     323430303a646330303a633030323a3a2f34382d3438203d3e20313331313131.roa (raw, json)
Hash identifier:          b9kMkb0KQQSYW/8TtP7XWDuEiaB0koC7lKLY6OsMkqg=
Subject key identifier:   A4:F3:03:7E:FB:35:33:C7:33:B9:DA:20:2A:BF:39:4B:CD:88:A5:0D
Certificate issuer:       /CN=C1AF8C999E9D06DADEBC387D78B305AB8716DC2F
Certificate serial:       0C457A27D6851ED3733E20555BD1F2681E1A38A3
Authority key identifier: C1:AF:8C:99:9E:9D:06:DA:DE:BC:38:7D:78:B3:05:AB:87:16:DC:2F
Authority info access:    rsync://repo-rpki.idnic.net/repo/IDNIC-ID/2/C1AF8C999E9D06DADEBC387D78B305AB8716DC2F.cer
Subject info access:      rsync://repo-rpki.idnic.net/repo/19205e7c-a881-4873-9188-e521b6af529c/0/323430303a646330303a633030323a3a2f34382d3438203d3e20313331313131.roa
Signing time:             Thu 03 Feb 2022 03:00:48 +0000
ROA not before:           Thu 03 Feb 2022 02:55:48 +0000
ROA not after:            Fri 03 Feb 2023 03:00:48 +0000
asID:                     131111
IP address blocks:        2400:dc00:c002::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0c:45:7a:27:d6:85:1e:d3:73:3e:20:55:5b:d1:f2:68:1e:1a:38:a3
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=C1AF8C999E9D06DADEBC387D78B305AB8716DC2F
        Validity
            Not Before: Feb  3 02:55:48 2022 GMT
            Not After : Feb  3 03:00:48 2023 GMT
        Subject: CN=3082010A0282010100DB8F07F90059BE556AEF3F44314B57855CE2B772F8889D3E6FEFDAE83B941FDBCCEBF039C4924AFDD2D71925FF69D2A803CCC60CDB3EB21CB30920569D68810883DFBF6AB67FAA2CA723F46EF87733BA2FF38116F558BDD29578A572486E5331D8532CE3DF965129DDDD7C933C9937B5836D0270AFAC7D5CA4FCE008F81677B9FEBB98C72E23FF5269E1D526E3BFAB39E09B2C849E41F0A2C2C8F3724190E5E9DF0376EF056FD0F521829AC592A156B20D044ABD42C9DAFF277CC167F085D96F67A4DA82020D160248182EDE841790DD01FB4984D46534C9C6F94D092A2794D3E0FB6932AFF3920955D4F4CBBCCC500FB4B64571ED89070E4C33AE0CB4C65C110203010001
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:db:8f:07:f9:00:59:be:55:6a:ef:3f:44:31:4b:
                    57:85:5c:e2:b7:72:f8:88:9d:3e:6f:ef:da:e8:3b:
                    94:1f:db:cc:eb:f0:39:c4:92:4a:fd:d2:d7:19:25:
                    ff:69:d2:a8:03:cc:c6:0c:db:3e:b2:1c:b3:09:20:
                    56:9d:68:81:08:83:df:bf:6a:b6:7f:aa:2c:a7:23:
                    f4:6e:f8:77:33:ba:2f:f3:81:16:f5:58:bd:d2:95:
                    78:a5:72:48:6e:53:31:d8:53:2c:e3:df:96:51:29:
                    dd:dd:7c:93:3c:99:37:b5:83:6d:02:70:af:ac:7d:
                    5c:a4:fc:e0:08:f8:16:77:b9:fe:bb:98:c7:2e:23:
                    ff:52:69:e1:d5:26:e3:bf:ab:39:e0:9b:2c:84:9e:
                    41:f0:a2:c2:c8:f3:72:41:90:e5:e9:df:03:76:ef:
                    05:6f:d0:f5:21:82:9a:c5:92:a1:56:b2:0d:04:4a:
                    bd:42:c9:da:ff:27:7c:c1:67:f0:85:d9:6f:67:a4:
                    da:82:02:0d:16:02:48:18:2e:de:84:17:90:dd:01:
                    fb:49:84:d4:65:34:c9:c6:f9:4d:09:2a:27:94:d3:
                    e0:fb:69:32:af:f3:92:09:55:d4:f4:cb:bc:cc:50:
                    0f:b4:b6:45:71:ed:89:07:0e:4c:33:ae:0c:b4:c6:
                    5c:11
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                A4:F3:03:7E:FB:35:33:C7:33:B9:DA:20:2A:BF:39:4B:CD:88:A5:0D
            X509v3 Authority Key Identifier:
                keyid:C1:AF:8C:99:9E:9D:06:DA:DE:BC:38:7D:78:B3:05:AB:87:16:DC:2F

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://repo-rpki.idnic.net/repo/19205e7c-a881-4873-9188-e521b6af529c/0/C1AF8C999E9D06DADEBC387D78B305AB8716DC2F.crl

            Authority Information Access:
                CA Issuers - URI:rsync://repo-rpki.idnic.net/repo/IDNIC-ID/2/C1AF8C999E9D06DADEBC387D78B305AB8716DC2F.cer

            Subject Information Access:
                Signed Object - URI:rsync://repo-rpki.idnic.net/repo/19205e7c-a881-4873-9188-e521b6af529c/0/323430303a646330303a633030323a3a2f34382d3438203d3e20313331313131.roa

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv6:
                  2400:dc00:c002::/48

    Signature Algorithm: sha256WithRSAEncryption
         60:9d:2f:c6:a4:43:cd:04:87:70:08:73:fb:6a:1b:e4:f4:67:
         d7:f2:9b:39:0a:45:36:18:73:3c:5a:68:50:73:d4:56:87:0c:
         cb:46:92:67:06:b5:b9:37:8c:d8:4f:5a:e0:b7:3e:d6:cf:a5:
         a0:3c:d1:29:8a:88:ca:da:a9:8b:25:3b:69:68:b9:43:77:d1:
         5c:eb:8f:1c:36:3b:df:62:e6:ca:89:03:ac:7f:35:39:7d:b2:
         13:ca:82:2d:54:aa:d3:a1:b0:d2:23:53:d2:32:1b:1b:73:1b:
         a6:da:ab:41:b6:29:61:5f:22:55:71:a9:88:89:e5:4d:c7:3b:
         98:6e:e4:d8:2b:3d:54:cf:bd:06:87:15:bf:a6:51:de:49:14:
         cc:f9:44:94:51:aa:73:ce:2c:ad:f1:5c:b9:57:7c:6c:78:ed:
         80:2a:d1:83:0d:ad:92:67:d4:6c:f7:3f:eb:b7:7a:dd:df:5f:
         d0:01:db:48:80:ca:04:ab:2e:bf:58:ea:f3:5e:51:a7:d5:ff:
         f0:f3:9e:54:b6:e8:f4:a7:19:e9:e8:68:06:b3:68:2c:10:3a:
         6c:5a:e5:d4:b1:34:f7:57:d3:82:ae:98:b9:33:21:c6:80:d2:
         fd:3d:7e:e3:fe:0a:b8:95:e4:ba:0f:43:35:78:82:49:f9:cd:
         ca:0f:c7:0f
-----BEGIN CERTIFICATE-----
MIIHMTCCBhmgAwIBAgIUDEV6J9aFHtNzPiBVW9HyaB4aOKMwDQYJKoZIhvcNAQEL
BQAwMzExMC8GA1UEAxMoQzFBRjhDOTk5RTlEMDZEQURFQkMzODdENzhCMzA1QUI4
NzE2REMyRjAeFw0yMjAyMDMwMjU1NDhaFw0yMzAyMDMwMzAwNDhaMIICLTGCAikw
ggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwREI4RjA3RjkwMDU5QkU1NTZB
RUYzRjQ0MzE0QjU3ODU1Q0UyQjc3MkY4ODg5RDNFNkZFRkRBRTgzQjk0MUZEQkND
RUJGMDM5QzQ5MjRBRkREMkQ3MTkyNUZGNjlEMkE4MDNDQ0M2MENEQjNFQjIxQ0Iz
MDkyMDU2OUQ2ODgxMDg4M0RGQkY2QUI2N0ZBQTJDQTcyM0Y0NkVGODc3MzNCQTJG
RjM4MTE2RjU1OEJERDI5NTc4QTU3MjQ4NkU1MzMxRDg1MzJDRTNERjk2NTEyOURE
REQ3QzkzM0M5OTM3QjU4MzZEMDI3MEFGQUM3RDVDQTRGQ0UwMDhGODE2NzdCOUZF
QkI5OEM3MkUyM0ZGNTI2OUUxRDUyNkUzQkZBQjM5RTA5QjJDODQ5RTQxRjBBMkMy
QzhGMzcyNDE5MEU1RTlERjAzNzZFRjA1NkZEMEY1MjE4MjlBQzU5MkExNTZCMjBE
MDQ0QUJENDJDOURBRkYyNzdDQzE2N0YwODVEOTZGNjdBNERBODIwMjBEMTYwMjQ4
MTgyRURFODQxNzkwREQwMUZCNDk4NEQ0NjUzNEM5QzZGOTREMDkyQTI3OTREM0Uw
RkI2OTMyQUZGMzkyMDk1NUQ0RjRDQkJDQ0M1MDBGQjRCNjQ1NzFFRDg5MDcwRTRD
MzNBRTBDQjRDNjVDMTEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEA248H+QBZvlVq7z9EMUtXhVzit3L4iJ0+b+/a6DuUH9vM6/A5xJJK
/dLXGSX/adKoA8zGDNs+shyzCSBWnWiBCIPfv2q2f6ospyP0bvh3M7ov84EW9Vi9
0pV4pXJIblMx2FMs49+WUSnd3XyTPJk3tYNtAnCvrH1cpPzgCPgWd7n+u5jHLiP/
Umnh1Sbjv6s54JsshJ5B8KLCyPNyQZDl6d8Ddu8Fb9D1IYKaxZKhVrINBEq9Qsna
/yd8wWfwhdlvZ6TaggINFgJIGC7ehBeQ3QH7SYTUZTTJxvlNCSonlNPg+2kyr/OS
CVXU9Mu8zFAPtLZFce2JBw5MM64MtMZcEQIDAQABo4ICPzCCAjswHQYDVR0OBBYE
FKTzA377NTPHM7naICq/OUvNiKUNMB8GA1UdIwQYMBaAFMGvjJmenQba3rw4fXiz
BauHFtwvMA4GA1UdDwEB/wQEAwIHgDCBhQYDVR0fBH4wfDB6oHigdoZ0cnN5bmM6
Ly9yZXBvLXJwa2kuaWRuaWMubmV0L3JlcG8vMTkyMDVlN2MtYTg4MS00ODczLTkx
ODgtZTUyMWI2YWY1MjljLzAvQzFBRjhDOTk5RTlEMDZEQURFQkMzODdENzhCMzA1
QUI4NzE2REMyRi5jcmwwdAYIKwYBBQUHAQEEaDBmMGQGCCsGAQUFBzAChlhyc3lu
YzovL3JlcG8tcnBraS5pZG5pYy5uZXQvcmVwby9JRE5JQy1JRC8yL0MxQUY4Qzk5
OUU5RDA2REFERUJDMzg3RDc4QjMwNUFCODcxNkRDMkYuY2VyMIGsBggrBgEFBQcB
CwSBnzCBnDCBmQYIKwYBBQUHMAuGgYxyc3luYzovL3JlcG8tcnBraS5pZG5pYy5u
ZXQvcmVwby8xOTIwNWU3Yy1hODgxLTQ4NzMtOTE4OC1lNTIxYjZhZjUyOWMvMC8z
MjM0MzAzMDNhNjQ2MzMwMzAzYTYzMzAzMDMyM2EzYTJmMzQzODJkMzQzODIwM2Qz
ZTIwMzEzMzMxMzEzMTMxLnJvYTAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCIG
CCsGAQUFBwEHAQH/BBMwETAPBAIAAjAJAwcAJADcAMACMA0GCSqGSIb3DQEBCwUA
A4IBAQBgnS/GpEPNBIdwCHP7ahvk9GfX8ps5CkU2GHM8WmhQc9RWhwzLRpJnBrW5
N4zYT1rgtz7Wz6WgPNEpiojK2qmLJTtpaLlDd9Fc648cNjvfYubKiQOsfzU5fbIT
yoItVKrTobDSI1PSMhsbcxum2qtBtilhXyJVcamIieVNxzuYbuTYKz1Uz70GhxW/
plHeSRTM+USUUapzziyt8Vy5V3xseO2AKtGDDa2SZ9Rs9z/rt3rd31/QAdtIgMoE
qy6/WOrzXlGn1f/w855Utuj0pxnp6GgGs2gsEDpsWuXUsTT3V9OCrpi5MyHGgNL9
PX7j/gq4leS6D0M1eIJJ+c3KD8cP
-----END CERTIFICATE-----