Route Origin Authorization

$ rpki-client -vvf rpki.apnic.net/member_repository/A911862D/32879D3AE8BA11E78A6A7042C4F9AE02/9AE12F1CB74111EDB0C38030C4F9AE02.roa
File:                     9AE12F1CB74111EDB0C38030C4F9AE02.roa (raw, json)
Hash identifier:          8RSjYugc2F9VWw0Ud3ECEZ6Drs3HKkHChTyELE7deCA=
Subject key identifier:   A1:32:C6:AA:73:C8:8E:B5:46:6E:36:B4:32:40:34:B6:83:49:11:B5
Certificate issuer:       /CN=A911862D/serialNumber=D8C673095E82A9B7E7DFCD46580F7831A8D18ACA
Certificate serial:       1636
Authority key identifier: D8:C6:73:09:5E:82:A9:B7:E7:DF:CD:46:58:0F:78:31:A8:D1:8A:CA
Authority info access:    rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/2MZzCV6Cqbfn381GWA94MajRiso.cer
Subject info access:      rsync://rpki.apnic.net/member_repository/A911862D/32879D3AE8BA11E78A6A7042C4F9AE02/9AE12F1CB74111EDB0C38030C4F9AE02.roa
Signing time:             Tue 30 Jan 2024 17:35:10 +0000
ROA not before:           Tue 30 Jan 2024 17:35:10 +0000
ROA not after:            Mon 31 Mar 2025 00:00:00 +0000
asID:                     137255
IP address blocks:        103.106.56.0/23 maxlen: 23
                          103.106.56.0/24 maxlen: 24
                          103.106.57.0/24 maxlen: 24
                          2402:3c40::/32 maxlen: 32

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 5686 (0x1636)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=A911862D/serialNumber=D8C673095E82A9B7E7DFCD46580F7831A8D18ACA
        Validity
            Not Before: Jan 30 17:35:10 2024 GMT
            Not After : Mar 31 00:00:00 2025 GMT
        Subject: CN=65b9334d-7af6
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:c0:63:3c:31:08:c4:c5:89:00:1f:81:78:d3:6c:
                    99:e5:b9:ad:36:50:4e:48:9d:89:7e:66:db:a3:3a:
                    2f:60:f9:17:2f:1e:7c:5b:2e:eb:cb:ff:e1:0f:75:
                    bb:9b:48:d5:9a:98:26:30:43:2d:7f:33:3b:c4:0b:
                    fc:78:4b:5e:e5:ac:fb:85:58:01:fe:b9:93:04:ae:
                    d7:00:d7:48:29:5f:d5:1a:d3:91:b0:cd:f3:6f:74:
                    bf:6b:18:15:6e:6c:a1:87:31:a2:3c:39:eb:c9:15:
                    78:75:30:40:cf:78:2a:8b:81:73:0c:0d:28:65:6c:
                    6a:9b:2a:d0:a6:99:b9:b7:2d:76:b6:3a:84:fb:f2:
                    f4:af:1b:e5:59:2a:85:3c:e7:1e:8e:f8:4e:25:ad:
                    a0:9f:56:de:5a:0a:5f:3c:98:0a:37:05:4a:3a:9d:
                    6f:52:e6:d3:63:bc:a1:01:16:69:84:12:7b:37:45:
                    b7:45:86:9a:75:33:07:f0:47:41:95:1b:96:55:a9:
                    32:e6:88:bd:30:58:67:18:44:d1:11:f9:32:d7:5f:
                    1f:1e:a7:37:7f:6b:d3:4b:69:6f:aa:8e:fa:14:e4:
                    b5:7f:fd:47:96:fd:3a:6f:4b:e0:e9:3b:d2:de:de:
                    d8:a7:3d:67:76:37:e4:65:1b:3e:8d:dc:e7:79:93:
                    16:c5
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                A1:32:C6:AA:73:C8:8E:B5:46:6E:36:B4:32:40:34:B6:83:49:11:B5
            X509v3 Authority Key Identifier:
                keyid:D8:C6:73:09:5E:82:A9:B7:E7:DF:CD:46:58:0F:78:31:A8:D1:8A:CA

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.apnic.net/member_repository/A911862D/32879D3AE8BA11E78A6A7042C4F9AE02/2MZzCV6Cqbfn381GWA94MajRiso.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/2MZzCV6Cqbfn381GWA94MajRiso.cer

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber
                  CPS: https://www.apnic.net/RPKI/CPS.pdf

            Subject Information Access:
                Signed Object - URI:rsync://rpki.apnic.net/member_repository/A911862D/32879D3AE8BA11E78A6A7042C4F9AE02/9AE12F1CB74111EDB0C38030C4F9AE02.roa
                RPKI Notify - URI:https://rrdp.apnic.net/notification.xml

            sbgp-ipAddrBlock: critical
                IPv4:
                  103.106.56.0/23
                IPv6:
                  2402:3c40::/32

    Signature Algorithm: sha256WithRSAEncryption
         6f:4c:7f:e9:06:d5:43:32:b6:7c:da:26:a0:d7:46:b0:08:1a:
         96:6a:79:5e:ba:36:a9:ef:e6:b4:ca:c6:7b:13:1e:b1:cf:c5:
         fc:54:5c:00:cc:4d:2d:ac:9c:43:46:65:91:85:ff:d4:6e:45:
         1a:9f:2b:b9:7c:17:e8:0c:46:81:c5:53:eb:db:38:a9:7d:72:
         df:d1:54:99:b6:a1:71:64:4e:2f:6c:38:a9:aa:58:10:f6:42:
         c5:b7:fb:03:3a:80:a9:be:71:7c:82:e7:a1:64:2a:c7:f2:ac:
         4c:b0:aa:88:72:0a:41:de:5a:e8:c7:10:31:53:4b:10:c1:07:
         77:66:3b:54:ce:7e:23:e8:89:95:70:82:0a:c2:08:55:39:ab:
         54:f7:8f:38:64:fd:9f:a7:80:b1:ae:a4:7e:b9:ff:63:5b:a9:
         6b:bd:59:ce:a4:ac:82:20:3b:76:94:8e:c2:d8:84:2d:07:97:
         80:8d:61:2d:ea:ba:73:27:6a:9a:37:ba:65:c0:71:36:5a:8c:
         1d:f7:5d:c4:41:3c:fc:5e:f1:ac:06:0e:68:64:4e:8c:1e:40:
         9b:97:53:b1:e9:e9:52:b5:35:c4:ca:6f:b9:e5:63:ec:58:cc:
         cc:3b:83:bf:e3:75:5d:34:f4:03:62:dc:22:50:66:16:8c:2c:
         05:c2:51:c9
-----BEGIN CERTIFICATE-----
MIIFgDCCBGigAwIBAgICFjYwDQYJKoZIhvcNAQELBQAwRjERMA8GA1UEAxMIQTkx
MTg2MkQxMTAvBgNVBAUTKEQ4QzY3MzA5NUU4MkE5QjdFN0RGQ0Q0NjU4MEY3ODMx
QThEMThBQ0EwHhcNMjQwMTMwMTczNTEwWhcNMjUwMzMxMDAwMDAwWjAYMRYwFAYD
VQQDEw02NWI5MzM0ZC03YWY2MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAwGM8MQjExYkAH4F402yZ5bmtNlBOSJ2JfmbbozovYPkXLx58Wy7ry//hD3W7
m0jVmpgmMEMtfzM7xAv8eEte5az7hVgB/rmTBK7XANdIKV/VGtORsM3zb3S/axgV
bmyhhzGiPDnryRV4dTBAz3gqi4FzDA0oZWxqmyrQppm5ty12tjqE+/L0rxvlWSqF
POcejvhOJa2gn1beWgpfPJgKNwVKOp1vUubTY7yhARZphBJ7N0W3RYaadTMH8EdB
lRuWVaky5oi9MFhnGETREfky118fHqc3f2vTS2lvqo76FOS1f/1Hlv06b0vg6TvS
3t7Ypz1ndjfkZRs+jdzneZMWxQIDAQABo4ICpDCCAqAwHQYDVR0OBBYEFKEyxqpz
yI61Rm42tDJANLaDSRG1MB8GA1UdIwQYMBaAFNjGcwlegqm359/NRlgPeDGo0YrK
MA4GA1UdDwEB/wQEAwIHgDCBgwYDVR0fBHwwejB4oHagdIZycnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9tZW1iZXJfcmVwb3NpdG9yeS9BOTExODYyRC8zMjg3OUQzQUU4
QkExMUU3OEE2QTcwNDJDNEY5QUUwMi8yTVp6Q1Y2Q3FiZm4zODFHV0E5NE1halJp
c28uY3JsMH4GCCsGAQUFBwEBBHIwcDBuBggrBgEFBQcwAoZicnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9yZXBvc2l0b3J5L0I1MjdFRjU4MUQ2NjExRTJCQjQ2OEY3Qzcy
RkQxRkYyLzJNWnpDVjZDcWJmbjM4MUdXQTk0TWFqUmlzby5jZXIwSgYDVR0gAQH/
BEAwPjA8BggrBgEFBQcOAjAwMC4GCCsGAQUFBwIBFiJodHRwczovL3d3dy5hcG5p
Yy5uZXQvUlBLSS9DUFMucGRmMIHLBggrBgEFBQcBCwSBvjCBuzCBgwYIKwYBBQUH
MAuGd3JzeW5jOi8vcnBraS5hcG5pYy5uZXQvbWVtYmVyX3JlcG9zaXRvcnkvQTkx
MTg2MkQvMzI4NzlEM0FFOEJBMTFFNzhBNkE3MDQyQzRGOUFFMDIvOUFFMTJGMUNC
NzQxMTFFREIwQzM4MDMwQzRGOUFFMDIucm9hMDMGCCsGAQUFBzANhidodHRwczov
L3JyZHAuYXBuaWMubmV0L25vdGlmaWNhdGlvbi54bWwwLgYIKwYBBQUHAQcBAf8E
HzAdMAwEAgABMAYDBAFnajgwDQQCAAIwBwMFACQCPEAwDQYJKoZIhvcNAQELBQAD
ggEBAG9Mf+kG1UMytnzaJqDXRrAIGpZqeV66Nqnv5rTKxnsTHrHPxfxUXADMTS2s
nENGZZGF/9RuRRqfK7l8F+gMRoHFU+vbOKl9ct/RVJm2oXFkTi9sOKmqWBD2QsW3
+wM6gKm+cXyC56FkKsfyrEywqohyCkHeWujHEDFTSxDBB3dmO1TOfiPoiZVwggrC
CFU5q1T3jzhk/Z+ngLGupH65/2NbqWu9Wc6krIIgO3aUjsLYhC0Hl4CNYS3qunMn
apo3umXAcTZajB33XcRBPPxe8awGDmhkToweQJuXU7Hp6VK1NcTKb7nlY+xYzMw7
g7/jdV009ANi3CJQZhaMLAXCUck=
-----END CERTIFICATE-----