Route Origin Authorization

$ rpki-client -vvf rpki.apnic.net/member_repository/A916F5D7/F7A1BB9C963D11E89FF3BD1AC4F9AE02/47BC9F4C963F11E8AEAEB41DC4F9AE02.roa
File:                     47BC9F4C963F11E8AEAEB41DC4F9AE02.roa (raw, json)
Hash identifier:          5uimFSbZ6c8Pw0JEClVmZMvp6UgRVCza101k6dRWuIU=
Subject key identifier:   66:B3:12:53:F9:00:81:DC:E1:73:A9:7B:89:97:4F:BA:D6:29:A2:1F
Certificate issuer:       /CN=A916F5D7/serialNumber=76BCA2FACC9FE7C840B1034DD2A59B6F69165CC5
Certificate serial:       10BF
Authority key identifier: 76:BC:A2:FA:CC:9F:E7:C8:40:B1:03:4D:D2:A5:9B:6F:69:16:5C:C5
Authority info access:    rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/dryi-syf58hAsQNN0qWbb2kWXMU.cer
Subject info access:      rsync://rpki.apnic.net/member_repository/A916F5D7/F7A1BB9C963D11E89FF3BD1AC4F9AE02/47BC9F4C963F11E8AEAEB41DC4F9AE02.roa
Signing time:             Wed 15 Jun 2022 06:01:23 +0000
ROA not before:           Wed 15 Jun 2022 06:01:23 +0000
ROA not after:            Sun 30 Jul 2023 00:00:00 +0000
asID:                     45828
IP address blocks:        103.14.1.0/24 maxlen: 24
                          103.103.84.0/22 maxlen: 24
                          203.217.148.0/23 maxlen: 24
                          2401:f040::/32 maxlen: 32

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 4287 (0x10bf)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=A916F5D7/serialNumber=76BCA2FACC9FE7C840B1034DD2A59B6F69165CC5
        Validity
            Not Before: Jun 15 06:01:23 2022 GMT
            Not After : Jul 30 00:00:00 2023 GMT
        Subject: CN=62a975b3-085e
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ca:b3:34:37:ed:24:f0:f8:11:40:b6:76:29:33:
                    f9:d9:7c:2a:90:14:78:bd:9b:78:87:87:79:64:94:
                    6b:23:54:72:0c:c3:11:06:3b:76:02:31:dc:44:5b:
                    1b:29:66:da:84:0c:4d:a2:91:00:7b:d8:3c:4f:f6:
                    5e:6c:0e:9c:f2:0b:59:c1:6e:9e:21:60:29:d9:a7:
                    f9:fb:13:21:a2:5f:99:41:13:4a:66:f9:bd:44:e4:
                    46:e5:d8:60:51:c7:c7:84:df:b0:60:77:fe:3d:1a:
                    48:43:50:c1:be:ec:e5:6d:45:63:0f:65:6b:4b:03:
                    b0:c4:85:ee:b5:ac:ec:dc:fc:0a:9a:b0:af:f9:99:
                    5e:20:73:56:47:5b:70:0c:b0:6a:0f:81:d6:a0:52:
                    72:f5:ad:8c:59:49:8c:95:a8:17:65:58:3a:97:85:
                    7f:d5:76:3e:e7:d0:84:6c:d4:71:26:9f:11:76:da:
                    6b:fe:fe:62:a8:77:5e:b3:a1:85:e6:b8:75:cb:c3:
                    a5:02:67:2e:62:44:c1:74:e8:4c:c4:5f:ab:c0:36:
                    7f:4a:60:5d:d6:d9:1b:88:5c:fb:b0:f5:94:5a:a8:
                    8d:41:ab:52:18:0e:4f:66:a7:ff:bf:46:2a:32:a1:
                    32:75:69:8e:84:1c:14:ed:a3:1b:6a:f8:14:bf:6a:
                    ba:e1
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                66:B3:12:53:F9:00:81:DC:E1:73:A9:7B:89:97:4F:BA:D6:29:A2:1F
            X509v3 Authority Key Identifier:
                keyid:76:BC:A2:FA:CC:9F:E7:C8:40:B1:03:4D:D2:A5:9B:6F:69:16:5C:C5

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.apnic.net/member_repository/A916F5D7/F7A1BB9C963D11E89FF3BD1AC4F9AE02/dryi-syf58hAsQNN0qWbb2kWXMU.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/dryi-syf58hAsQNN0qWbb2kWXMU.cer

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber
                  CPS: https://www.apnic.net/RPKI/CPS.pdf

            Subject Information Access:
                Signed Object - URI:rsync://rpki.apnic.net/member_repository/A916F5D7/F7A1BB9C963D11E89FF3BD1AC4F9AE02/47BC9F4C963F11E8AEAEB41DC4F9AE02.roa
                RPKI Notify - URI:https://rrdp.apnic.net/notification.xml

            sbgp-ipAddrBlock: critical
                IPv4:
                  103.14.1.0/24
                  103.103.84.0/22
                  203.217.148.0/23
                IPv6:
                  2401:f040::/32

    Signature Algorithm: sha256WithRSAEncryption
         4d:73:c4:c6:75:b3:f2:1c:35:87:8f:31:2d:1e:5a:5c:cd:ca:
         c9:07:0e:71:e4:b6:0f:e4:92:1a:5f:00:b0:f8:52:e1:9c:7b:
         8b:02:80:cd:52:ab:67:a8:2e:b0:08:0f:e4:60:1b:71:52:06:
         16:06:94:44:90:92:f5:80:c9:2c:09:f0:ec:19:3a:4c:08:6f:
         37:2e:1a:4c:06:16:d2:96:aa:45:0c:4a:3a:93:76:23:56:e2:
         7c:a5:17:49:1f:1e:47:b0:cf:78:d7:ae:20:c2:1c:1b:af:bc:
         a2:ba:fe:17:11:fd:37:4e:ab:5e:41:cd:08:c4:f4:eb:28:40:
         45:7c:c5:63:6b:c5:6b:f4:ea:b9:ec:2f:66:88:e6:5a:cf:3f:
         a9:bb:c8:cb:b6:fa:70:6d:9f:4f:2c:ce:d1:5f:85:1e:24:8e:
         13:94:7d:62:aa:18:cf:7c:22:3b:d8:fc:7e:60:73:d6:af:71:
         17:2c:08:da:6e:ff:aa:f4:59:cc:34:7f:2e:81:e4:ad:0e:2f:
         43:f4:d6:47:27:ca:4a:ba:b4:89:5e:d2:d7:3e:b7:e8:a5:e9:
         c2:f4:fc:64:a8:90:7d:b2:0e:b4:32:c3:73:fc:01:2f:d6:8d:
         23:4d:2b:b3:3c:d4:65:12:d2:87:24:95:72:5a:fa:14:74:49:
         b5:ef:ab:9a
-----BEGIN CERTIFICATE-----
MIIFjDCCBHSgAwIBAgICEL8wDQYJKoZIhvcNAQELBQAwRjERMA8GA1UEAxMIQTkx
NkY1RDcxMTAvBgNVBAUTKDc2QkNBMkZBQ0M5RkU3Qzg0MEIxMDM0REQyQTU5QjZG
NjkxNjVDQzUwHhcNMjIwNjE1MDYwMTIzWhcNMjMwNzMwMDAwMDAwWjAYMRYwFAYD
VQQDEw02MmE5NzViMy0wODVlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAyrM0N+0k8PgRQLZ2KTP52XwqkBR4vZt4h4d5ZJRrI1RyDMMRBjt2AjHcRFsb
KWbahAxNopEAe9g8T/ZebA6c8gtZwW6eIWAp2af5+xMhol+ZQRNKZvm9RORG5dhg
UcfHhN+wYHf+PRpIQ1DBvuzlbUVjD2VrSwOwxIXutazs3PwKmrCv+ZleIHNWR1tw
DLBqD4HWoFJy9a2MWUmMlagXZVg6l4V/1XY+59CEbNRxJp8Rdtpr/v5iqHdes6GF
5rh1y8OlAmcuYkTBdOhMxF+rwDZ/SmBd1tkbiFz7sPWUWqiNQatSGA5PZqf/v0Yq
MqEydWmOhBwU7aMbavgUv2q64QIDAQABo4ICsDCCAqwwHQYDVR0OBBYEFGazElP5
AIHc4XOpe4mXT7rWKaIfMB8GA1UdIwQYMBaAFHa8ovrMn+fIQLEDTdKlm29pFlzF
MA4GA1UdDwEB/wQEAwIHgDCBgwYDVR0fBHwwejB4oHagdIZycnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9tZW1iZXJfcmVwb3NpdG9yeS9BOTE2RjVENy9GN0ExQkI5Qzk2
M0QxMUU4OUZGM0JEMUFDNEY5QUUwMi9kcnlpLXN5ZjU4aEFzUU5OMHFXYmIya1dY
TVUuY3JsMH4GCCsGAQUFBwEBBHIwcDBuBggrBgEFBQcwAoZicnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9yZXBvc2l0b3J5L0I1MjdFRjU4MUQ2NjExRTJCQjQ2OEY3Qzcy
RkQxRkYyL2RyeWktc3lmNThoQXNRTk4wcVdiYjJrV1hNVS5jZXIwSgYDVR0gAQH/
BEAwPjA8BggrBgEFBQcOAjAwMC4GCCsGAQUFBwIBFiJodHRwczovL3d3dy5hcG5p
Yy5uZXQvUlBLSS9DUFMucGRmMIHLBggrBgEFBQcBCwSBvjCBuzCBgwYIKwYBBQUH
MAuGd3JzeW5jOi8vcnBraS5hcG5pYy5uZXQvbWVtYmVyX3JlcG9zaXRvcnkvQTkx
NkY1RDcvRjdBMUJCOUM5NjNEMTFFODlGRjNCRDFBQzRGOUFFMDIvNDdCQzlGNEM5
NjNGMTFFOEFFQUVCNDFEQzRGOUFFMDIucm9hMDMGCCsGAQUFBzANhidodHRwczov
L3JyZHAuYXBuaWMubmV0L25vdGlmaWNhdGlvbi54bWwwOgYIKwYBBQUHAQcBAf8E
KzApMBgEAgABMBIDBABnDgEDBAJnZ1QDBAHL2ZQwDQQCAAIwBwMFACQB8EAwDQYJ
KoZIhvcNAQELBQADggEBAE1zxMZ1s/IcNYePMS0eWlzNyskHDnHktg/kkhpfALD4
UuGce4sCgM1Sq2eoLrAID+RgG3FSBhYGlESQkvWAySwJ8OwZOkwIbzcuGkwGFtKW
qkUMSjqTdiNW4nylF0kfHkewz3jXriDCHBuvvKK6/hcR/TdOq15BzQjE9OsoQEV8
xWNrxWv06rnsL2aI5lrPP6m7yMu2+nBtn08sztFfhR4kjhOUfWKqGM98IjvY/H5g
c9avcRcsCNpu/6r0Wcw0fy6B5K0OL0P01kcnykq6tIle0tc+t+il6cL0/GSokH2y
DrQyw3P8AS/WjSNNK7M81GUS0ocklXJa+hR0SbXvq5o=
-----END CERTIFICATE-----