Route Origin Authorization

$ rpki-client -vvf repo-rpki.idnic.net/repo/19205e7c-a881-4873-9188-e521b6af529c/0/323430303a646330303a633030343a3a2f34382d3438203d3e20313331313131.roa
File:                     323430303a646330303a633030343a3a2f34382d3438203d3e20313331313131.roa (raw, json)
Hash identifier:          gEgN1HFtVK4koZYjn+qq4Dp7rWwkmLSwi/3+vChYPAs=
Subject key identifier:   CA:D3:AE:7E:A1:82:0D:8F:5D:B7:0D:59:C0:E6:6D:5E:3C:85:94:91
Certificate issuer:       /CN=C1AF8C999E9D06DADEBC387D78B305AB8716DC2F
Certificate serial:       5552ECCB2CDD78527FFEA33E6E55D1C7A67BC7AC
Authority key identifier: C1:AF:8C:99:9E:9D:06:DA:DE:BC:38:7D:78:B3:05:AB:87:16:DC:2F
Authority info access:    rsync://repo-rpki.idnic.net/repo/IDNIC-ID/2/C1AF8C999E9D06DADEBC387D78B305AB8716DC2F.cer
Subject info access:      rsync://repo-rpki.idnic.net/repo/19205e7c-a881-4873-9188-e521b6af529c/0/323430303a646330303a633030343a3a2f34382d3438203d3e20313331313131.roa
Signing time:             Thu 03 Feb 2022 03:00:48 +0000
ROA not before:           Thu 03 Feb 2022 02:55:48 +0000
ROA not after:            Fri 03 Feb 2023 03:00:48 +0000
asID:                     131111
IP address blocks:        2400:dc00:c004::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            55:52:ec:cb:2c:dd:78:52:7f:fe:a3:3e:6e:55:d1:c7:a6:7b:c7:ac
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=C1AF8C999E9D06DADEBC387D78B305AB8716DC2F
        Validity
            Not Before: Feb  3 02:55:48 2022 GMT
            Not After : Feb  3 03:00:48 2023 GMT
        Subject: CN=3082010A0282010100ACADA6DE160AE16809B0581D97D8C367B107D04708736B215C71FACE9830CB4F3F27AC5E8A1C8ED9ED698F46A841C8BF0E30301D4662D027E95BC0EBA23253B6DE5E847AA346E36D4CCC3167AFB3CE7240BF81FFF579938CE2D7AFA65F47DBD50EE326649B2FDEFAB12BF61B8E3C78B09AAACE2603153D46C2BD0DD35F1940B708426399199F1998CF5FE1F7CD6E85AADAF9841C2E89F56AA38CD6583FEE4E3F2C669677852C98015CD6ECDA62D1363B236E476DF51D538ED98CE55649C04862665A94F4434B5DAC569F1284AC56AC99C6DFA69EAF4A8E8F222E1B42C4D4E94EFDC3B25070993DDAF50AD18968AA85A3EEF0CBC86641F8E861F3E84A525F10970203010001
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ac:ad:a6:de:16:0a:e1:68:09:b0:58:1d:97:d8:
                    c3:67:b1:07:d0:47:08:73:6b:21:5c:71:fa:ce:98:
                    30:cb:4f:3f:27:ac:5e:8a:1c:8e:d9:ed:69:8f:46:
                    a8:41:c8:bf:0e:30:30:1d:46:62:d0:27:e9:5b:c0:
                    eb:a2:32:53:b6:de:5e:84:7a:a3:46:e3:6d:4c:cc:
                    31:67:af:b3:ce:72:40:bf:81:ff:f5:79:93:8c:e2:
                    d7:af:a6:5f:47:db:d5:0e:e3:26:64:9b:2f:de:fa:
                    b1:2b:f6:1b:8e:3c:78:b0:9a:aa:ce:26:03:15:3d:
                    46:c2:bd:0d:d3:5f:19:40:b7:08:42:63:99:19:9f:
                    19:98:cf:5f:e1:f7:cd:6e:85:aa:da:f9:84:1c:2e:
                    89:f5:6a:a3:8c:d6:58:3f:ee:4e:3f:2c:66:96:77:
                    85:2c:98:01:5c:d6:ec:da:62:d1:36:3b:23:6e:47:
                    6d:f5:1d:53:8e:d9:8c:e5:56:49:c0:48:62:66:5a:
                    94:f4:43:4b:5d:ac:56:9f:12:84:ac:56:ac:99:c6:
                    df:a6:9e:af:4a:8e:8f:22:2e:1b:42:c4:d4:e9:4e:
                    fd:c3:b2:50:70:99:3d:da:f5:0a:d1:89:68:aa:85:
                    a3:ee:f0:cb:c8:66:41:f8:e8:61:f3:e8:4a:52:5f:
                    10:97
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                CA:D3:AE:7E:A1:82:0D:8F:5D:B7:0D:59:C0:E6:6D:5E:3C:85:94:91
            X509v3 Authority Key Identifier:
                keyid:C1:AF:8C:99:9E:9D:06:DA:DE:BC:38:7D:78:B3:05:AB:87:16:DC:2F

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://repo-rpki.idnic.net/repo/19205e7c-a881-4873-9188-e521b6af529c/0/C1AF8C999E9D06DADEBC387D78B305AB8716DC2F.crl

            Authority Information Access:
                CA Issuers - URI:rsync://repo-rpki.idnic.net/repo/IDNIC-ID/2/C1AF8C999E9D06DADEBC387D78B305AB8716DC2F.cer

            Subject Information Access:
                Signed Object - URI:rsync://repo-rpki.idnic.net/repo/19205e7c-a881-4873-9188-e521b6af529c/0/323430303a646330303a633030343a3a2f34382d3438203d3e20313331313131.roa

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv6:
                  2400:dc00:c004::/48

    Signature Algorithm: sha256WithRSAEncryption
         1b:6a:8a:34:27:f9:12:10:9e:dc:4a:f9:44:2f:e3:df:7b:2f:
         86:ea:c9:66:c5:8f:4b:4f:76:8c:17:a7:25:40:8e:0f:1e:90:
         c2:46:bd:b3:99:98:a1:cf:99:a8:91:a4:50:91:8b:09:6a:cf:
         0a:f0:8f:99:66:d1:2d:22:dc:03:61:2c:a9:57:84:c3:6e:ae:
         84:fb:a7:cb:ce:15:bc:b7:9a:19:9c:1d:61:8f:04:0b:16:bc:
         07:a4:38:bb:27:33:01:a0:93:66:9a:ad:ec:be:a0:dd:2c:e8:
         d8:c4:bd:e6:b4:8e:f9:54:c7:00:31:72:08:30:f4:16:55:6a:
         b5:33:ab:68:c5:74:48:b4:5a:1d:62:59:da:3e:3c:40:f2:59:
         72:39:d8:c9:f1:a9:07:31:24:34:0f:7e:02:33:13:79:5a:88:
         3d:a8:32:b2:79:2f:4b:b1:f2:db:f1:a4:21:50:35:9f:de:6c:
         67:e3:53:8c:ca:9e:16:e5:fc:03:cd:2a:b0:e1:3c:c0:d5:c1:
         6d:e7:3a:e0:e2:1c:e4:cb:8f:3f:63:7a:d0:28:67:5c:d9:1f:
         e0:06:99:4f:50:aa:af:26:e4:11:11:b9:e7:27:f3:8e:f7:16:
         2d:4e:10:dd:24:68:bb:da:9e:ab:86:b7:5d:31:69:d1:bd:b7:
         ed:96:31:3d
-----BEGIN CERTIFICATE-----
MIIHMTCCBhmgAwIBAgIUVVLsyyzdeFJ//qM+blXRx6Z7x6wwDQYJKoZIhvcNAQEL
BQAwMzExMC8GA1UEAxMoQzFBRjhDOTk5RTlEMDZEQURFQkMzODdENzhCMzA1QUI4
NzE2REMyRjAeFw0yMjAyMDMwMjU1NDhaFw0yMzAyMDMwMzAwNDhaMIICLTGCAikw
ggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQUNBREE2REUxNjBBRTE2ODA5
QjA1ODFEOTdEOEMzNjdCMTA3RDA0NzA4NzM2QjIxNUM3MUZBQ0U5ODMwQ0I0RjNG
MjdBQzVFOEExQzhFRDlFRDY5OEY0NkE4NDFDOEJGMEUzMDMwMUQ0NjYyRDAyN0U5
NUJDMEVCQTIzMjUzQjZERTVFODQ3QUEzNDZFMzZENENDQzMxNjdBRkIzQ0U3MjQw
QkY4MUZGRjU3OTkzOENFMkQ3QUZBNjVGNDdEQkQ1MEVFMzI2NjQ5QjJGREVGQUIx
MkJGNjFCOEUzQzc4QjA5QUFBQ0UyNjAzMTUzRDQ2QzJCRDBERDM1RjE5NDBCNzA4
NDI2Mzk5MTk5RjE5OThDRjVGRTFGN0NENkU4NUFBREFGOTg0MUMyRTg5RjU2QUEz
OENENjU4M0ZFRTRFM0YyQzY2OTY3Nzg1MkM5ODAxNUNENkVDREE2MkQxMzYzQjIz
NkU0NzZERjUxRDUzOEVEOThDRTU1NjQ5QzA0ODYyNjY1QTk0RjQ0MzRCNURBQzU2
OUYxMjg0QUM1NkFDOTlDNkRGQTY5RUFGNEE4RThGMjIyRTFCNDJDNEQ0RTk0RUZE
QzNCMjUwNzA5OTNEREFGNTBBRDE4OTY4QUE4NUEzRUVGMENCQzg2NjQxRjhFODYx
RjNFODRBNTI1RjEwOTcwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEArK2m3hYK4WgJsFgdl9jDZ7EH0EcIc2shXHH6zpgwy08/J6xeihyO
2e1pj0aoQci/DjAwHUZi0CfpW8DrojJTtt5ehHqjRuNtTMwxZ6+zznJAv4H/9XmT
jOLXr6ZfR9vVDuMmZJsv3vqxK/Ybjjx4sJqqziYDFT1Gwr0N018ZQLcIQmOZGZ8Z
mM9f4ffNboWq2vmEHC6J9WqjjNZYP+5OPyxmlneFLJgBXNbs2mLRNjsjbkdt9R1T
jtmM5VZJwEhiZlqU9ENLXaxWnxKErFasmcbfpp6vSo6PIi4bQsTU6U79w7JQcJk9
2vUK0YloqoWj7vDLyGZB+Ohh8+hKUl8QlwIDAQABo4ICPzCCAjswHQYDVR0OBBYE
FMrTrn6hgg2PXbcNWcDmbV48hZSRMB8GA1UdIwQYMBaAFMGvjJmenQba3rw4fXiz
BauHFtwvMA4GA1UdDwEB/wQEAwIHgDCBhQYDVR0fBH4wfDB6oHigdoZ0cnN5bmM6
Ly9yZXBvLXJwa2kuaWRuaWMubmV0L3JlcG8vMTkyMDVlN2MtYTg4MS00ODczLTkx
ODgtZTUyMWI2YWY1MjljLzAvQzFBRjhDOTk5RTlEMDZEQURFQkMzODdENzhCMzA1
QUI4NzE2REMyRi5jcmwwdAYIKwYBBQUHAQEEaDBmMGQGCCsGAQUFBzAChlhyc3lu
YzovL3JlcG8tcnBraS5pZG5pYy5uZXQvcmVwby9JRE5JQy1JRC8yL0MxQUY4Qzk5
OUU5RDA2REFERUJDMzg3RDc4QjMwNUFCODcxNkRDMkYuY2VyMIGsBggrBgEFBQcB
CwSBnzCBnDCBmQYIKwYBBQUHMAuGgYxyc3luYzovL3JlcG8tcnBraS5pZG5pYy5u
ZXQvcmVwby8xOTIwNWU3Yy1hODgxLTQ4NzMtOTE4OC1lNTIxYjZhZjUyOWMvMC8z
MjM0MzAzMDNhNjQ2MzMwMzAzYTYzMzAzMDM0M2EzYTJmMzQzODJkMzQzODIwM2Qz
ZTIwMzEzMzMxMzEzMTMxLnJvYTAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCIG
CCsGAQUFBwEHAQH/BBMwETAPBAIAAjAJAwcAJADcAMAEMA0GCSqGSIb3DQEBCwUA
A4IBAQAbaoo0J/kSEJ7cSvlEL+Pfey+G6slmxY9LT3aMF6clQI4PHpDCRr2zmZih
z5mokaRQkYsJas8K8I+ZZtEtItwDYSypV4TDbq6E+6fLzhW8t5oZnB1hjwQLFrwH
pDi7JzMBoJNmmq3svqDdLOjYxL3mtI75VMcAMXIIMPQWVWq1M6toxXRItFodYlna
PjxA8llyOdjJ8akHMSQ0D34CMxN5Wog9qDKyeS9LsfLb8aQhUDWf3mxn41OMyp4W
5fwDzSqw4TzA1cFt5zrg4hzky48/Y3rQKGdc2R/gBplPUKqvJuQREbnnJ/OO9xYt
ThDdJGi72p6rhrddMWnRvbftljE9
-----END CERTIFICATE-----