Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/22/635511-71f3-4f57-9139-7da3cd253bf6/1/oiJmXJwxwJ7CYlYeecD26efJUrw.roa
File:                     oiJmXJwxwJ7CYlYeecD26efJUrw.roa (raw, json)
Hash identifier:          qaAoV779Ia+65K94QzieDhqfoGP/fsHo9oT4GgAKjPc=
Subject key identifier:   A2:22:66:5C:9C:31:C0:9E:C2:62:56:1E:79:C0:F6:E9:E7:C9:52:BC
Certificate issuer:       /CN=e7478550068bf78220408c25d612bc2fb02460c1
Certificate serial:       018E4C7D52234BAEFA9FA8D5B2C62ABB2A12
Authority key identifier: E7:47:85:50:06:8B:F7:82:20:40:8C:25:D6:12:BC:2F:B0:24:60:C1
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/50eFUAaL94IgQIwl1hK8L7AkYME.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/22/635511-71f3-4f57-9139-7da3cd253bf6/1/oiJmXJwxwJ7CYlYeecD26efJUrw.roa
Signing time:             Sun 17 Mar 2024 12:57:45 +0000
ROA not before:           Sun 17 Mar 2024 12:57:45 +0000
ROA not after:            Tue 01 Jul 2025 00:00:00 +0000
asID:                     21507
IP address blocks:        217.142.16.0/20 maxlen: 20

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8e:4c:7d:52:23:4b:ae:fa:9f:a8:d5:b2:c6:2a:bb:2a:12
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=e7478550068bf78220408c25d612bc2fb02460c1
        Validity
            Not Before: Mar 17 12:57:45 2024 GMT
            Not After : Jul  1 00:00:00 2025 GMT
        Subject: CN=a222665c9c31c09ec262561e79c0f6e9e7c952bc
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:bd:a3:21:8c:85:16:58:eb:bd:0d:cc:c6:17:18:
                    44:4d:d3:40:d1:41:76:52:eb:ab:ff:6a:0c:28:07:
                    36:4e:bb:de:f6:b1:29:b6:ed:53:b5:18:db:1c:87:
                    65:5f:31:b0:84:56:df:77:bc:db:82:dc:71:d7:8a:
                    3a:2e:9b:f4:2f:ae:81:04:09:41:3b:6c:c9:b6:e0:
                    a0:46:2f:0e:f2:df:e7:e7:79:4f:30:ca:b9:0c:a6:
                    58:8c:9f:d4:e9:c3:90:74:9e:38:fd:93:fd:f9:51:
                    41:4d:68:aa:48:ff:da:8d:8f:45:a7:ef:7b:da:9a:
                    4c:e3:a3:c6:07:80:9c:f8:48:4f:b8:26:45:df:67:
                    30:17:e7:b9:c4:b8:63:ca:ef:29:10:de:c7:c0:f4:
                    9a:92:48:5b:c9:6b:29:26:8a:80:3d:91:6c:5d:dc:
                    ae:0b:0c:d0:e4:54:cf:2d:83:90:dd:6b:76:13:11:
                    5e:ee:90:90:6c:af:b2:c6:92:df:6e:7a:89:aa:0f:
                    07:9c:d4:63:8a:6e:52:47:2a:58:8f:8d:11:76:5c:
                    96:ca:9b:a8:77:bf:8c:d9:44:25:fa:6d:f1:2e:e7:
                    25:a8:ab:12:2d:b7:09:d8:42:21:2f:e1:0c:87:4d:
                    cb:43:90:00:60:5f:48:d8:33:f5:8f:cc:d6:7e:1c:
                    d5:45
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                A2:22:66:5C:9C:31:C0:9E:C2:62:56:1E:79:C0:F6:E9:E7:C9:52:BC
            X509v3 Authority Key Identifier:
                keyid:E7:47:85:50:06:8B:F7:82:20:40:8C:25:D6:12:BC:2F:B0:24:60:C1

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/50eFUAaL94IgQIwl1hK8L7AkYME.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/22/635511-71f3-4f57-9139-7da3cd253bf6/1/oiJmXJwxwJ7CYlYeecD26efJUrw.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/22/635511-71f3-4f57-9139-7da3cd253bf6/1/50eFUAaL94IgQIwl1hK8L7AkYME.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv4:
                  217.142.16.0/20

    Signature Algorithm: sha256WithRSAEncryption
         70:29:fe:47:01:19:d4:3e:64:58:f1:c9:87:8e:e7:ad:9e:27:
         1f:ca:3a:97:65:28:f0:1b:53:77:1b:55:ad:0c:86:a7:f8:80:
         0c:4a:98:30:68:d0:7d:ba:fc:09:2b:d4:27:bd:c0:21:8b:fc:
         0b:2e:ee:a8:6b:14:3d:7e:fe:bb:bf:43:c1:8e:31:29:38:56:
         d5:6c:17:1e:9b:56:e4:7d:aa:2d:9e:a1:f5:74:2d:0d:52:17:
         17:20:15:cf:ff:95:48:f8:30:1f:44:1f:cf:4a:b2:97:09:7a:
         c8:8a:af:8a:99:62:d6:24:62:2b:f2:56:70:fd:56:f4:b0:f8:
         fa:38:3c:d9:bd:2e:41:79:9b:41:78:02:6d:e6:b3:fd:d3:64:
         e2:fc:1d:39:82:e5:be:b6:2b:8a:e1:81:52:0e:5e:9b:4f:c6:
         42:f3:f6:d3:8a:7a:fb:e3:17:32:f2:be:45:5c:58:e3:8c:5c:
         c1:bb:41:99:70:de:44:03:e7:84:fa:b3:6d:d9:07:32:fc:63:
         57:65:75:90:a1:f1:f7:fd:1d:76:a5:1f:2b:c1:21:48:bb:b6:
         87:c2:dc:37:b6:92:a1:85:d2:ff:dc:1a:34:63:ba:e9:a2:7e:
         ec:a2:20:96:9d:6e:77:ad:e4:81:00:33:f4:ef:0b:10:8f:a6:
         16:1d:51:87
-----BEGIN CERTIFICATE-----
MIIE/TCCA+WgAwIBAgISAY5MfVIjS676n6jVssYquyoSMA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKGU3NDc4NTUwMDY4YmY3ODIyMDQwOGMyNWQ2MTJiYzJmYjAy
NDYwYzEwHhcNMjQwMzE3MTI1NzQ1WhcNMjUwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
EyhhMjIyNjY1YzljMzFjMDllYzI2MjU2MWU3OWMwZjZlOWU3Yzk1MmJjMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvaMhjIUWWOu9DczGFxhETdNA0UF2
Uuur/2oMKAc2Trve9rEptu1TtRjbHIdlXzGwhFbfd7zbgtxx14o6Lpv0L66BBAlB
O2zJtuCgRi8O8t/n53lPMMq5DKZYjJ/U6cOQdJ44/ZP9+VFBTWiqSP/ajY9Fp+97
2ppM46PGB4Cc+EhPuCZF32cwF+e5xLhjyu8pEN7HwPSakkhbyWspJoqAPZFsXdyu
CwzQ5FTPLYOQ3Wt2ExFe7pCQbK+yxpLfbnqJqg8HnNRjim5SRypYj40RdlyWypuo
d7+M2UQl+m3xLuclqKsSLbcJ2EIhL+EMh03LQ5AAYF9I2DP1j8zWfhzVRQIDAQAB
o4ICCTCCAgUwHQYDVR0OBBYEFKIiZlycMcCewmJWHnnA9unnyVK8MB8GA1UdIwQY
MBaAFOdHhVAGi/eCIECMJdYSvC+wJGDBMA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvNTBlRlVBYUw5NElnUUl3bDFoSzhMN0FrWU1FLmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC8yMi82MzU1MTEtNzFmMy00ZjU3LTkxMzkt
N2RhM2NkMjUzYmY2LzEvb2lKbVhKd3h3SjdDWWxZZWVjRDI2ZWZKVXJ3LnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC8yMi82MzU1MTEtNzFmMy00ZjU3LTkxMzktN2RhM2NkMjUzYmY2
LzEvNTBlRlVBYUw5NElnUUl3bDFoSzhMN0FrWU1FLmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMB8GCCsGAQUFBwEHAQH/BBAwDjAMBAIAATAGAwQE2Y4QMA0G
CSqGSIb3DQEBCwUAA4IBAQBwKf5HARnUPmRY8cmHjuetnicfyjqXZSjwG1N3G1Wt
DIan+IAMSpgwaNB9uvwJK9QnvcAhi/wLLu6oaxQ9fv67v0PBjjEpOFbVbBcem1bk
faotnqH1dC0NUhcXIBXP/5VI+DAfRB/PSrKXCXrIiq+KmWLWJGIr8lZw/Vb0sPj6
ODzZvS5BeZtBeAJt5rP902Ti/B05guW+tiuK4YFSDl6bT8ZC8/bTinr74xcy8r5F
XFjjjFzBu0GZcN5EA+eE+rNt2Qcy/GNXZXWQofH3/R12pR8rwSFIu7aHwtw3tpKh
hdL/3Bo0Y7rpon7soiCWnW53reSBADP07wsQj6YWHVGH
-----END CERTIFICATE-----