Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/2e/6d59d9-9daf-4fcb-8d05-13bcc752119a/1/JZ86IUfl0o36DVxrvg3zG1rNsrg.roa
File:                     JZ86IUfl0o36DVxrvg3zG1rNsrg.roa (raw, json)
Hash identifier:          FXtIJZah5jFVPUJGrZlQmwdOgH+aAN3r092nKNroJzg=
Subject key identifier:   25:9F:3A:21:47:E5:D2:8D:FA:0D:5C:6B:BE:0D:F3:1B:5A:CD:B2:B8
Certificate issuer:       /CN=b07ab922565e2b3e2cc63d485a55dd4fc41d357e
Certificate serial:       018CC64B282803F1F6FE0D25F305E7E0CA3D
Authority key identifier: B0:7A:B9:22:56:5E:2B:3E:2C:C6:3D:48:5A:55:DD:4F:C4:1D:35:7E
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/sHq5IlZeKz4sxj1IWlXdT8QdNX4.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/2e/6d59d9-9daf-4fcb-8d05-13bcc752119a/1/JZ86IUfl0o36DVxrvg3zG1rNsrg.roa
Signing time:             Mon 01 Jan 2024 18:31:03 +0000
ROA not before:           Mon 01 Jan 2024 18:31:03 +0000
ROA not after:            Tue 01 Jul 2025 00:00:00 +0000
asID:                     150325
IP address blocks:        2a12:f8c1:10::/44 maxlen: 44
                          2a12:f8c1:7::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8c:c6:4b:28:28:03:f1:f6:fe:0d:25:f3:05:e7:e0:ca:3d
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=b07ab922565e2b3e2cc63d485a55dd4fc41d357e
        Validity
            Not Before: Jan  1 18:31:03 2024 GMT
            Not After : Jul  1 00:00:00 2025 GMT
        Subject: CN=259f3a2147e5d28dfa0d5c6bbe0df31b5acdb2b8
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:bc:17:64:4b:e3:b1:f5:79:1e:59:6d:a5:b7:3f:
                    70:75:36:fc:de:55:05:da:88:9c:d6:74:e2:cb:91:
                    df:a5:ac:a6:1e:95:9d:ec:6b:60:27:4a:e9:0c:a2:
                    cb:54:65:cb:1e:ab:8a:ae:d5:4e:4d:27:5a:53:58:
                    74:91:fd:be:82:9f:94:b4:cb:4d:1e:86:07:2c:9d:
                    47:06:0e:fa:b8:c4:a8:38:42:e8:bd:87:79:4e:b1:
                    58:8d:7a:24:cd:fc:6e:7c:22:bb:3d:9f:e4:6a:af:
                    58:94:82:fc:82:bd:e6:d9:f9:f0:75:ab:0b:ca:38:
                    01:af:b9:c9:1a:80:b1:3d:e4:8b:17:31:53:53:f7:
                    2b:c9:d9:f8:85:98:37:0e:91:c6:6a:a2:a4:3d:96:
                    80:41:3a:63:a6:0a:67:ec:fa:3d:02:db:9b:cf:0d:
                    eb:e0:66:34:88:4a:f9:8b:0e:ea:fa:49:e2:e7:00:
                    6f:d1:b1:38:6c:d6:bb:79:40:83:d0:82:bd:db:90:
                    84:1a:25:64:fb:78:8c:bf:9a:92:48:ca:17:c8:f2:
                    ec:12:a4:ed:d0:c7:bc:6c:cd:2e:96:25:da:fa:e3:
                    7e:99:9d:4e:63:ae:b3:07:03:c8:5c:71:8d:08:ce:
                    c1:82:67:4c:93:4d:de:39:c3:44:5e:f8:d7:9e:de:
                    97:83
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                25:9F:3A:21:47:E5:D2:8D:FA:0D:5C:6B:BE:0D:F3:1B:5A:CD:B2:B8
            X509v3 Authority Key Identifier:
                keyid:B0:7A:B9:22:56:5E:2B:3E:2C:C6:3D:48:5A:55:DD:4F:C4:1D:35:7E

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/sHq5IlZeKz4sxj1IWlXdT8QdNX4.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/2e/6d59d9-9daf-4fcb-8d05-13bcc752119a/1/JZ86IUfl0o36DVxrvg3zG1rNsrg.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/2e/6d59d9-9daf-4fcb-8d05-13bcc752119a/1/sHq5IlZeKz4sxj1IWlXdT8QdNX4.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv6:
                  2a12:f8c1:7::/48
                  2a12:f8c1:10::/44

    Signature Algorithm: sha256WithRSAEncryption
         a3:73:85:41:b4:a7:93:4e:42:ca:3c:df:7a:c6:15:3d:4c:28:
         a0:2a:79:21:f7:25:91:f3:cb:b6:2a:14:93:f5:ee:a9:b5:e9:
         e7:4d:34:3b:a2:1d:d6:ff:07:c2:8b:98:8e:92:8f:73:59:d3:
         2a:83:b6:3c:0a:34:37:fe:af:1b:93:08:6d:5d:73:4a:66:1d:
         98:ca:a6:50:b7:47:44:01:33:cd:99:7b:cc:bd:37:ee:b2:aa:
         9c:8b:ed:dd:38:5c:a6:fd:4c:53:ce:12:56:94:2e:5e:a8:a5:
         06:2a:cb:f8:c8:62:fa:96:6a:61:ef:77:d8:bd:58:18:6c:84:
         c1:6c:7e:7a:aa:c4:c7:a7:30:e8:20:b2:40:16:4f:2f:15:49:
         bb:47:ac:6a:17:19:4d:69:cd:26:ec:fb:e7:2c:93:e2:63:53:
         8c:28:52:ac:d1:30:04:2d:ea:6a:01:69:da:e5:5f:3c:2b:5d:
         9b:2c:1a:dd:30:07:a4:75:ea:88:89:71:c5:8e:18:08:f7:de:
         22:ce:ba:ab:26:18:83:e9:05:61:f6:3a:08:3c:33:0a:42:fe:
         9a:6e:38:24:f8:3b:c5:e5:fc:23:5c:a4:ad:4a:2f:ef:2d:46:
         32:9e:48:2b:30:db:7c:6e:7a:df:d8:a1:7f:47:2d:8a:9a:c1:
         fb:b9:87:99
-----BEGIN CERTIFICATE-----
MIIFCTCCA/GgAwIBAgISAYzGSygoA/H2/g0l8wXn4Mo9MA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKGIwN2FiOTIyNTY1ZTJiM2UyY2M2M2Q0ODVhNTVkZDRmYzQx
ZDM1N2UwHhcNMjQwMTAxMTgzMTAzWhcNMjUwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
EygyNTlmM2EyMTQ3ZTVkMjhkZmEwZDVjNmJiZTBkZjMxYjVhY2RiMmI4MIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvBdkS+Ox9XkeWW2ltz9wdTb83lUF
2oic1nTiy5HfpaymHpWd7GtgJ0rpDKLLVGXLHquKrtVOTSdaU1h0kf2+gp+UtMtN
HoYHLJ1HBg76uMSoOELovYd5TrFYjXokzfxufCK7PZ/kaq9YlIL8gr3m2fnwdasL
yjgBr7nJGoCxPeSLFzFTU/crydn4hZg3DpHGaqKkPZaAQTpjpgpn7Po9Atubzw3r
4GY0iEr5iw7q+kni5wBv0bE4bNa7eUCD0IK925CEGiVk+3iMv5qSSMoXyPLsEqTt
0Me8bM0uliXa+uN+mZ1OY66zBwPIXHGNCM7BgmdMk03eOcNEXvjXnt6XgwIDAQAB
o4ICFTCCAhEwHQYDVR0OBBYEFCWfOiFH5dKN+g1ca74N8xtazbK4MB8GA1UdIwQY
MBaAFLB6uSJWXis+LMY9SFpV3U/EHTV+MA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvc0hxNUlsWmVLejRzeGoxSVdsWGRUOFFkTlg0LmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC8yZS82ZDU5ZDktOWRhZi00ZmNiLThkMDUt
MTNiY2M3NTIxMTlhLzEvSlo4NklVZmwwbzM2RFZ4cnZnM3pHMXJOc3JnLnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC8yZS82ZDU5ZDktOWRhZi00ZmNiLThkMDUtMTNiY2M3NTIxMTlh
LzEvc0hxNUlsWmVLejRzeGoxSVdsWGRUOFFkTlg0LmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMCsGCCsGAQUFBwEHAQH/BBwwGjAYBAIAAjASAwcAKhL4wQAH
AwcEKhL4wQAQMA0GCSqGSIb3DQEBCwUAA4IBAQCjc4VBtKeTTkLKPN96xhU9TCig
Knkh9yWR88u2KhST9e6ptennTTQ7oh3W/wfCi5iOko9zWdMqg7Y8CjQ3/q8bkwht
XXNKZh2YyqZQt0dEATPNmXvMvTfusqqci+3dOFym/UxTzhJWlC5eqKUGKsv4yGL6
lmph73fYvVgYbITBbH56qsTHpzDoILJAFk8vFUm7R6xqFxlNac0m7PvnLJPiY1OM
KFKs0TAELepqAWna5V88K12bLBrdMAekdeqIiXHFjhgI994izrqrJhiD6QVh9joI
PDMKQv6abjgk+DvF5fwjXKStSi/vLUYynkgrMNt8bnrf2KF/Ry2KmsH7uYeZ
-----END CERTIFICATE-----