Route Origin Authorization

$ rpki-client -vvf rpki.apnic.net/member_repository/A919B06C/E9D62E74FEAE11E8910D4D66C4F9AE02/8CEE67F4E8E211ECAE1EF17FC4F9AE02.roa
File:                     8CEE67F4E8E211ECAE1EF17FC4F9AE02.roa (raw, json)
Hash identifier:          vgwArZgWcbCbpjpjtWLSomwR9Z5Z2292VJ2JU9JIrvQ=
Subject key identifier:   DF:77:11:CB:AB:E4:3E:FF:1A:3E:6D:8E:3E:56:6F:E4:1E:1D:E5:0C
Certificate issuer:       /CN=A919B06C/serialNumber=C83493C0297CCB58D2837946D6063F14A7DEE986
Certificate serial:       0B0C
Authority key identifier: C8:34:93:C0:29:7C:CB:58:D2:83:79:46:D6:06:3F:14:A7:DE:E9:86
Authority info access:    rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/yDSTwCl8y1jSg3lG1gY_FKfe6YY.cer
Subject info access:      rsync://rpki.apnic.net/member_repository/A919B06C/E9D62E74FEAE11E8910D4D66C4F9AE02/8CEE67F4E8E211ECAE1EF17FC4F9AE02.roa
Signing time:             Fri 10 Jun 2022 17:27:07 +0000
ROA not before:           Fri 10 Jun 2022 17:27:07 +0000
ROA not after:            Sun 28 May 2023 00:00:00 +0000
asID:                     18230
IP address blocks:        59.152.0.0/20 maxlen: 20
                          59.152.0.0/24 maxlen: 24
                          59.152.1.0/24 maxlen: 24
                          59.152.2.0/24 maxlen: 24
                          59.152.4.0/24 maxlen: 24
                          59.152.5.0/24 maxlen: 24
                          59.152.6.0/24 maxlen: 24
                          59.152.7.0/24 maxlen: 24
                          59.152.8.0/24 maxlen: 24
                          59.152.9.0/24 maxlen: 24
                          59.152.10.0/24 maxlen: 24
                          59.152.11.0/24 maxlen: 24
                          59.152.12.0/24 maxlen: 24
                          59.152.13.0/24 maxlen: 24
                          59.152.91.0/24 maxlen: 24
                          203.189.224.0/21 maxlen: 24
                          2404:1b40::/32 maxlen: 32
                          2404:1b40::/48 maxlen: 48
                          2404:1b40:1::/48 maxlen: 48
                          2404:1b40:2::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2828 (0xb0c)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=A919B06C/serialNumber=C83493C0297CCB58D2837946D6063F14A7DEE986
        Validity
            Not Before: Jun 10 17:27:07 2022 GMT
            Not After : May 28 00:00:00 2023 GMT
        Subject: CN=62a37eeb-2c50
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:c1:cb:0e:88:16:27:13:74:b3:c0:da:f9:3c:ce:
                    1d:e6:a2:49:95:d0:72:c3:b2:e2:be:22:26:61:37:
                    66:f2:fc:60:af:95:f6:16:7e:ba:5e:12:f2:1c:e8:
                    1f:5a:d4:5a:ed:f5:93:85:5c:1f:ee:44:13:1f:0d:
                    2e:f8:4d:4e:9e:88:bb:f3:65:2a:36:71:28:ad:78:
                    b9:27:29:b9:07:24:47:0f:a3:d4:cf:ca:c2:51:76:
                    8b:fb:f4:8d:60:d9:e1:35:ba:12:c3:c1:df:76:f0:
                    af:bd:d9:fa:f0:a5:8c:3c:f3:45:72:54:c1:a0:00:
                    07:d7:8d:13:10:1f:f0:30:a4:78:ca:2a:e8:7e:17:
                    6b:30:e9:5a:ec:d5:b6:ec:4f:a6:3b:80:67:12:ff:
                    fa:0d:36:2a:f9:80:03:cd:d0:f0:2e:8c:d7:ac:22:
                    b8:ef:e7:21:7e:26:40:12:b8:50:ec:f6:10:3e:ab:
                    ee:29:a1:bb:c0:5a:60:02:62:87:7b:e6:2c:04:c2:
                    9d:99:fa:0a:d6:8e:4e:3f:02:bc:ba:7d:9c:8f:22:
                    ee:d7:8b:0c:e7:c4:49:b0:fd:80:45:19:a5:41:56:
                    6b:1a:fd:f7:ca:65:4c:4d:52:aa:6c:d4:2c:d8:39:
                    89:07:a8:f9:d3:5a:60:07:c2:d3:d9:89:8b:7e:5b:
                    ff:4d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                DF:77:11:CB:AB:E4:3E:FF:1A:3E:6D:8E:3E:56:6F:E4:1E:1D:E5:0C
            X509v3 Authority Key Identifier:
                keyid:C8:34:93:C0:29:7C:CB:58:D2:83:79:46:D6:06:3F:14:A7:DE:E9:86

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.apnic.net/member_repository/A919B06C/E9D62E74FEAE11E8910D4D66C4F9AE02/yDSTwCl8y1jSg3lG1gY_FKfe6YY.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/yDSTwCl8y1jSg3lG1gY_FKfe6YY.cer

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber
                  CPS: https://www.apnic.net/RPKI/CPS.pdf

            Subject Information Access:
                Signed Object - URI:rsync://rpki.apnic.net/member_repository/A919B06C/E9D62E74FEAE11E8910D4D66C4F9AE02/8CEE67F4E8E211ECAE1EF17FC4F9AE02.roa
                RPKI Notify - URI:https://rrdp.apnic.net/notification.xml

            sbgp-ipAddrBlock: critical
                IPv4:
                  59.152.0.0/20
                  59.152.91.0/24
                  203.189.224.0/21
                IPv6:
                  2404:1b40::/32

    Signature Algorithm: sha256WithRSAEncryption
         96:d1:cf:51:8d:9f:1f:4c:9b:f1:8a:19:3e:80:38:12:e6:48:
         7b:97:3f:84:83:0c:f8:5c:c5:55:47:e5:69:63:2e:78:ff:ee:
         43:16:80:1a:0e:39:c5:ef:aa:44:45:a7:61:e4:e8:4f:b1:8f:
         5e:92:b5:88:58:3a:d0:ed:3d:cd:3b:9a:8e:43:4f:f8:0a:89:
         03:38:65:fa:cc:e5:67:9a:78:a9:d2:47:8d:34:8a:bc:23:6d:
         80:f0:07:be:4e:67:ec:86:1e:31:1e:4f:b2:ba:29:97:96:be:
         67:e9:46:52:c5:11:2a:13:83:62:01:a7:c2:bb:e1:0e:8c:54:
         68:47:d5:99:0c:92:79:90:bb:51:c0:21:74:76:6a:c1:a5:a3:
         5e:dc:a7:d3:e2:26:ea:fe:fc:39:ca:54:82:66:95:2b:53:07:
         09:71:ef:1b:60:1c:02:bc:cf:50:70:50:ee:2f:2f:16:a0:e0:
         72:0d:3e:08:0a:2c:68:06:bf:a9:34:64:ca:c1:cb:a5:c0:65:
         91:e4:fe:3a:08:e7:59:31:51:82:ad:dd:e4:2a:08:03:2a:d7:
         57:c7:b9:77:32:31:88:18:23:bb:af:f4:fc:67:b9:ec:a1:be:
         85:cd:84:6f:5a:06:97:a4:41:fb:89:85:e6:02:0a:76:9b:2f:
         c5:76:a4:68
-----BEGIN CERTIFICATE-----
MIIFjDCCBHSgAwIBAgICCwwwDQYJKoZIhvcNAQELBQAwRjERMA8GA1UEAxMIQTkx
OUIwNkMxMTAvBgNVBAUTKEM4MzQ5M0MwMjk3Q0NCNThEMjgzNzk0NkQ2MDYzRjE0
QTdERUU5ODYwHhcNMjIwNjEwMTcyNzA3WhcNMjMwNTI4MDAwMDAwWjAYMRYwFAYD
VQQDEw02MmEzN2VlYi0yYzUwMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAwcsOiBYnE3SzwNr5PM4d5qJJldByw7LiviImYTdm8vxgr5X2Fn66XhLyHOgf
WtRa7fWThVwf7kQTHw0u+E1Onoi782UqNnEorXi5Jym5ByRHD6PUz8rCUXaL+/SN
YNnhNboSw8HfdvCvvdn68KWMPPNFclTBoAAH140TEB/wMKR4yirofhdrMOla7NW2
7E+mO4BnEv/6DTYq+YADzdDwLozXrCK47+chfiZAErhQ7PYQPqvuKaG7wFpgAmKH
e+YsBMKdmfoK1o5OPwK8un2cjyLu14sM58RJsP2ARRmlQVZrGv33ymVMTVKqbNQs
2DmJB6j501pgB8LT2YmLflv/TQIDAQABo4ICsDCCAqwwHQYDVR0OBBYEFN93Ecur
5D7/Gj5tjj5Wb+QeHeUMMB8GA1UdIwQYMBaAFMg0k8ApfMtY0oN5RtYGPxSn3umG
MA4GA1UdDwEB/wQEAwIHgDCBgwYDVR0fBHwwejB4oHagdIZycnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9tZW1iZXJfcmVwb3NpdG9yeS9BOTE5QjA2Qy9FOUQ2MkU3NEZF
QUUxMUU4OTEwRDRENjZDNEY5QUUwMi95RFNUd0NsOHkxalNnM2xHMWdZX0ZLZmU2
WVkuY3JsMH4GCCsGAQUFBwEBBHIwcDBuBggrBgEFBQcwAoZicnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9yZXBvc2l0b3J5L0I1MjdFRjU4MUQ2NjExRTJCQjQ2OEY3Qzcy
RkQxRkYyL3lEU1R3Q2w4eTFqU2czbEcxZ1lfRktmZTZZWS5jZXIwSgYDVR0gAQH/
BEAwPjA8BggrBgEFBQcOAjAwMC4GCCsGAQUFBwIBFiJodHRwczovL3d3dy5hcG5p
Yy5uZXQvUlBLSS9DUFMucGRmMIHLBggrBgEFBQcBCwSBvjCBuzCBgwYIKwYBBQUH
MAuGd3JzeW5jOi8vcnBraS5hcG5pYy5uZXQvbWVtYmVyX3JlcG9zaXRvcnkvQTkx
OUIwNkMvRTlENjJFNzRGRUFFMTFFODkxMEQ0RDY2QzRGOUFFMDIvOENFRTY3RjRF
OEUyMTFFQ0FFMUVGMTdGQzRGOUFFMDIucm9hMDMGCCsGAQUFBzANhidodHRwczov
L3JyZHAuYXBuaWMubmV0L25vdGlmaWNhdGlvbi54bWwwOgYIKwYBBQUHAQcBAf8E
KzApMBgEAgABMBIDBAQ7mAADBAA7mFsDBAPLveAwDQQCAAIwBwMFACQEG0AwDQYJ
KoZIhvcNAQELBQADggEBAJbRz1GNnx9Mm/GKGT6AOBLmSHuXP4SDDPhcxVVH5Wlj
Lnj/7kMWgBoOOcXvqkRFp2Hk6E+xj16StYhYOtDtPc07mo5DT/gKiQM4ZfrM5Wea
eKnSR400irwjbYDwB75OZ+yGHjEeT7K6KZeWvmfpRlLFESoTg2IBp8K74Q6MVGhH
1ZkMknmQu1HAIXR2asGlo17cp9PiJur+/DnKVIJmlStTBwlx7xtgHAK8z1BwUO4v
Lxag4HINPggKLGgGv6k0ZMrBy6XAZZHk/joI51kxUYKt3eQqCAMq11fHuXcyMYgY
I7uv9PxnueyhvoXNhG9aBpekQfuJheYCCnabL8V2pGg=
-----END CERTIFICATE-----