Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/1d/89ec25-72dc-4f0f-8b2f-ad7890c2e752/1/1-qhlAu1h6-5cpkzqtENER4I0Slg.roa
File:                     1-qhlAu1h6-5cpkzqtENER4I0Slg.roa (raw, json)
Hash identifier:          PaJMAo34qNeKrS36ZBJ/VoRik5J5Cx+uA0ZaFUmFos8=
Subject key identifier:   FA:A8:65:02:ED:61:EB:EE:5C:A6:4C:EA:B4:43:44:47:82:34:4A:58
Certificate issuer:       /CN=5bd74e39dda400d136126e6c3efb1cf9344277ef
Certificate serial:       018ECC45E934DCE9881D5F58AB6F8DC4C3E1
Authority key identifier: 5B:D7:4E:39:DD:A4:00:D1:36:12:6E:6C:3E:FB:1C:F9:34:42:77:EF
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/W9dOOd2kANE2Em5sPvsc-TRCd-8.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/1d/89ec25-72dc-4f0f-8b2f-ad7890c2e752/1/1-qhlAu1h6-5cpkzqtENER4I0Slg.roa
Signing time:             Thu 11 Apr 2024 08:28:37 +0000
ROA not before:           Thu 11 Apr 2024 08:28:37 +0000
ROA not after:            Tue 01 Jul 2025 00:00:00 +0000
asID:                     213220
IP address blocks:        2a11:5181::/32 maxlen: 32
                          2a11:5185::/32 maxlen: 32
                          2a11:5187::/32 maxlen: 32
                          2a11:68c6::/32 maxlen: 32
                          2a11:aac0::/32 maxlen: 32
                          2a11:aac5::/32 maxlen: 32

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8e:cc:45:e9:34:dc:e9:88:1d:5f:58:ab:6f:8d:c4:c3:e1
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=5bd74e39dda400d136126e6c3efb1cf9344277ef
        Validity
            Not Before: Apr 11 08:28:37 2024 GMT
            Not After : Jul  1 00:00:00 2025 GMT
        Subject: CN=faa86502ed61ebee5ca64ceab443444782344a58
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:86:d1:3d:5b:aa:b5:c8:2e:28:d4:09:d7:73:26:
                    15:70:fb:9a:6d:d5:22:42:17:0d:c4:91:02:ee:ac:
                    56:64:fe:60:60:06:10:eb:ad:43:72:35:5a:c9:79:
                    88:1e:df:4c:b3:1b:48:5b:61:43:68:48:4d:c3:bd:
                    2a:7b:62:98:c8:2f:57:8e:f2:db:0c:33:b7:06:25:
                    1c:5e:d9:c5:d9:92:72:d8:4a:bb:17:b5:2c:72:ff:
                    a0:9d:0c:7a:08:05:c0:f0:08:99:1f:97:86:39:7e:
                    9b:72:ad:e0:ee:e6:4e:b2:c1:39:16:e7:42:02:5f:
                    73:eb:8a:71:71:52:fe:28:94:24:b9:d0:c5:ef:df:
                    77:a4:0e:a9:f0:3d:ad:e3:45:76:13:96:94:68:17:
                    57:00:15:7b:04:d6:3b:66:72:00:b6:bd:c3:51:36:
                    df:25:9f:4c:a6:4c:3d:46:db:ea:ab:fa:ea:a3:95:
                    7b:ab:03:54:8c:73:d5:89:31:48:d0:b0:e0:91:7d:
                    fe:75:f0:55:a9:dd:17:6a:36:e8:14:80:a0:84:cd:
                    7e:92:76:12:a7:4c:eb:62:26:4f:f4:58:61:c1:e6:
                    8a:ee:76:3c:62:05:ad:68:b9:0e:2b:71:97:bd:38:
                    ec:a9:0e:ac:c0:44:d6:2d:b5:54:00:da:65:6e:a5:
                    59:31
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                FA:A8:65:02:ED:61:EB:EE:5C:A6:4C:EA:B4:43:44:47:82:34:4A:58
            X509v3 Authority Key Identifier:
                keyid:5B:D7:4E:39:DD:A4:00:D1:36:12:6E:6C:3E:FB:1C:F9:34:42:77:EF

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/W9dOOd2kANE2Em5sPvsc-TRCd-8.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/1d/89ec25-72dc-4f0f-8b2f-ad7890c2e752/1/1-qhlAu1h6-5cpkzqtENER4I0Slg.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/1d/89ec25-72dc-4f0f-8b2f-ad7890c2e752/1/W9dOOd2kANE2Em5sPvsc-TRCd-8.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv6:
                  2a11:5181::/32
                  2a11:5185::/32
                  2a11:5187::/32
                  2a11:68c6::/32
                  2a11:aac0::/32
                  2a11:aac5::/32

    Signature Algorithm: sha256WithRSAEncryption
         96:61:a1:8f:d4:f1:a2:8f:54:b1:3e:ce:78:2e:86:c7:24:f8:
         a2:61:a8:3f:f4:99:05:92:a2:97:91:d2:be:65:7e:c8:c5:ec:
         52:ef:cc:28:3f:07:6c:72:33:d7:74:ae:72:c9:cb:4b:31:06:
         84:c3:77:cc:ce:2a:a0:11:29:18:8b:92:0e:22:0e:c7:5a:dc:
         6c:72:9d:b5:9e:04:17:b3:35:19:9f:4a:49:b2:7c:d6:30:99:
         b6:77:9f:e9:77:e5:a9:02:2d:be:9e:fe:8a:6b:07:bd:51:03:
         a0:88:da:74:0d:53:83:90:ad:7e:89:b1:59:c7:95:36:ed:79:
         b9:8c:11:85:a7:fc:7b:0a:e0:6b:51:d3:48:94:e7:0a:76:fb:
         61:75:8e:46:e5:d5:ea:8f:9a:86:a5:19:cb:06:58:54:71:f0:
         c1:28:e0:9b:4f:68:cb:44:39:69:4f:77:7c:d2:9f:96:49:9c:
         83:eb:e9:9b:de:9d:da:52:a8:4c:f8:59:f6:88:3a:17:a0:4c:
         f0:2c:89:fa:cd:3c:2b:18:e6:75:03:9a:e0:4a:04:2a:e1:42:
         64:6c:b9:4f:ea:d6:26:57:b1:df:51:dd:26:cf:e8:92:ba:ad:
         f7:79:46:5c:cf:f4:b8:85:df:3e:1d:98:57:d6:cd:59:70:42:
         b9:b2:64:72
-----BEGIN CERTIFICATE-----
MIIFIjCCBAqgAwIBAgISAY7MRek03OmIHV9Yq2+NxMPhMA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKDViZDc0ZTM5ZGRhNDAwZDEzNjEyNmU2YzNlZmIxY2Y5MzQ0
Mjc3ZWYwHhcNMjQwNDExMDgyODM3WhcNMjUwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
EyhmYWE4NjUwMmVkNjFlYmVlNWNhNjRjZWFiNDQzNDQ0NzgyMzQ0YTU4MIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhtE9W6q1yC4o1AnXcyYVcPuabdUi
QhcNxJEC7qxWZP5gYAYQ661DcjVayXmIHt9MsxtIW2FDaEhNw70qe2KYyC9XjvLb
DDO3BiUcXtnF2ZJy2Eq7F7Uscv+gnQx6CAXA8AiZH5eGOX6bcq3g7uZOssE5FudC
Al9z64pxcVL+KJQkudDF7993pA6p8D2t40V2E5aUaBdXABV7BNY7ZnIAtr3DUTbf
JZ9Mpkw9Rtvqq/rqo5V7qwNUjHPViTFI0LDgkX3+dfBVqd0XajboFICghM1+knYS
p0zrYiZP9FhhweaK7nY8YgWtaLkOK3GXvTjsqQ6swETWLbVUANplbqVZMQIDAQAB
o4ICLjCCAiowHQYDVR0OBBYEFPqoZQLtYevuXKZM6rRDREeCNEpYMB8GA1UdIwQY
MBaAFFvXTjndpADRNhJubD77HPk0QnfvMA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvVzlkT09kMmtBTkUyRW01c1B2c2MtVFJDZC04LmNlcjCB
jgYIKwYBBQUHAQsEgYEwfzB9BggrBgEFBQcwC4ZxcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC8xZC84OWVjMjUtNzJkYy00ZjBmLThiMmYt
YWQ3ODkwYzJlNzUyLzEvMS1xaGxBdTFoNi01Y3BrenF0RU5FUjRJMFNsZy5yb2Ew
gYEGA1UdHwR6MHgwdqB0oHKGcHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBvc2l0
b3J5L0RFRkFVTFQvMWQvODllYzI1LTcyZGMtNGYwZi04YjJmLWFkNzg5MGMyZTc1
Mi8xL1c5ZE9PZDJrQU5FMkVtNXNQdnNjLVRSQ2QtOC5jcmwwGAYDVR0gAQH/BA4w
DDAKBggrBgEFBQcOAjBDBggrBgEFBQcBBwEB/wQ0MDIwMAQCAAIwKgMFACoRUYED
BQAqEVGFAwUAKhFRhwMFACoRaMYDBQAqEarAAwUAKhGqxTANBgkqhkiG9w0BAQsF
AAOCAQEAlmGhj9Txoo9UsT7OeC6GxyT4omGoP/SZBZKil5HSvmV+yMXsUu/MKD8H
bHIz13SucsnLSzEGhMN3zM4qoBEpGIuSDiIOx1rcbHKdtZ4EF7M1GZ9KSbJ81jCZ
tnef6XflqQItvp7+imsHvVEDoIjadA1Tg5CtfomxWceVNu15uYwRhaf8ewrga1HT
SJTnCnb7YXWORuXV6o+ahqUZywZYVHHwwSjgm09oy0Q5aU93fNKflkmcg+vpm96d
2lKoTPhZ9og6F6BM8CyJ+s08KxjmdQOa4EoEKuFCZGy5T+rWJlex31HdJs/okrqt
93lGXM/0uIXfPh2YV9bNWXBCubJkcg==
-----END CERTIFICATE-----