Route Origin Authorization

$ rpki-client -vvf repo-rpki.idnic.net/repo/19205e7c-a881-4873-9188-e521b6af529c/0/323430303a646330303a343030323a3a2f34382d3438203d3e20313331313131.roa
File:                     323430303a646330303a343030323a3a2f34382d3438203d3e20313331313131.roa (raw, json)
Hash identifier:          N6cgwuA1zRDBoB7yjOHUEMqbAi1XIVkOa2VDJT9O/3w=
Subject key identifier:   F6:DD:E9:04:A3:51:5B:8C:91:27:54:7D:F6:98:5D:6E:9D:DC:60:91
Certificate issuer:       /CN=C1AF8C999E9D06DADEBC387D78B305AB8716DC2F
Certificate serial:       1058D23ABA198B4994E91E2A74230B235FD03371
Authority key identifier: C1:AF:8C:99:9E:9D:06:DA:DE:BC:38:7D:78:B3:05:AB:87:16:DC:2F
Authority info access:    rsync://repo-rpki.idnic.net/repo/IDNIC-ID/2/C1AF8C999E9D06DADEBC387D78B305AB8716DC2F.cer
Subject info access:      rsync://repo-rpki.idnic.net/repo/19205e7c-a881-4873-9188-e521b6af529c/0/323430303a646330303a343030323a3a2f34382d3438203d3e20313331313131.roa
Signing time:             Wed 09 Feb 2022 07:44:55 +0000
ROA not before:           Wed 09 Feb 2022 07:39:55 +0000
ROA not after:            Thu 09 Feb 2023 07:44:55 +0000
asID:                     131111
IP address blocks:        2400:dc00:4002::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            10:58:d2:3a:ba:19:8b:49:94:e9:1e:2a:74:23:0b:23:5f:d0:33:71
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=C1AF8C999E9D06DADEBC387D78B305AB8716DC2F
        Validity
            Not Before: Feb  9 07:39:55 2022 GMT
            Not After : Feb  9 07:44:55 2023 GMT
        Subject: CN=3082010A02820101009C811618CB06C4C372D2231AB10BFD1F6E2FA459C57ABAB0C632A24098BDF8EDA69FE64E32C862F26EABEF2BD6B6A9AB9352AC71BB5A4E110EE2E2198FB8C132D700A94126070A0CABF3999D396443EEF58478279ADEAE8D19ED288AF90DC1BB80FCFBE991D051E808D9FDCD9A08261913A6693A9C494E7D3131CDDF262EFF0B2F699016B95B23819D5C9B063091691456365C495154C495C0A1CE7AECB24F17E40EB29D4AFC5C70AFA247D65AFD403DCD35947E01C012CC82543E4C676F9FF35D98DF74B42B8442E419A1B30B73F1BE0B1ED67BD43280637981933E4EC33601ABD6769853AD35B1CA1FF12B3EF714063DCABEB39FC17FCE0110BC8050398DFB0203010001
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:9c:81:16:18:cb:06:c4:c3:72:d2:23:1a:b1:0b:
                    fd:1f:6e:2f:a4:59:c5:7a:ba:b0:c6:32:a2:40:98:
                    bd:f8:ed:a6:9f:e6:4e:32:c8:62:f2:6e:ab:ef:2b:
                    d6:b6:a9:ab:93:52:ac:71:bb:5a:4e:11:0e:e2:e2:
                    19:8f:b8:c1:32:d7:00:a9:41:26:07:0a:0c:ab:f3:
                    99:9d:39:64:43:ee:f5:84:78:27:9a:de:ae:8d:19:
                    ed:28:8a:f9:0d:c1:bb:80:fc:fb:e9:91:d0:51:e8:
                    08:d9:fd:cd:9a:08:26:19:13:a6:69:3a:9c:49:4e:
                    7d:31:31:cd:df:26:2e:ff:0b:2f:69:90:16:b9:5b:
                    23:81:9d:5c:9b:06:30:91:69:14:56:36:5c:49:51:
                    54:c4:95:c0:a1:ce:7a:ec:b2:4f:17:e4:0e:b2:9d:
                    4a:fc:5c:70:af:a2:47:d6:5a:fd:40:3d:cd:35:94:
                    7e:01:c0:12:cc:82:54:3e:4c:67:6f:9f:f3:5d:98:
                    df:74:b4:2b:84:42:e4:19:a1:b3:0b:73:f1:be:0b:
                    1e:d6:7b:d4:32:80:63:79:81:93:3e:4e:c3:36:01:
                    ab:d6:76:98:53:ad:35:b1:ca:1f:f1:2b:3e:f7:14:
                    06:3d:ca:be:b3:9f:c1:7f:ce:01:10:bc:80:50:39:
                    8d:fb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                F6:DD:E9:04:A3:51:5B:8C:91:27:54:7D:F6:98:5D:6E:9D:DC:60:91
            X509v3 Authority Key Identifier:
                keyid:C1:AF:8C:99:9E:9D:06:DA:DE:BC:38:7D:78:B3:05:AB:87:16:DC:2F

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://repo-rpki.idnic.net/repo/19205e7c-a881-4873-9188-e521b6af529c/0/C1AF8C999E9D06DADEBC387D78B305AB8716DC2F.crl

            Authority Information Access:
                CA Issuers - URI:rsync://repo-rpki.idnic.net/repo/IDNIC-ID/2/C1AF8C999E9D06DADEBC387D78B305AB8716DC2F.cer

            Subject Information Access:
                Signed Object - URI:rsync://repo-rpki.idnic.net/repo/19205e7c-a881-4873-9188-e521b6af529c/0/323430303a646330303a343030323a3a2f34382d3438203d3e20313331313131.roa

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv6:
                  2400:dc00:4002::/48

    Signature Algorithm: sha256WithRSAEncryption
         62:43:cf:47:a7:8d:55:01:5b:8e:72:66:e5:27:02:c8:c1:32:
         50:fd:7b:b6:ba:1b:12:20:4e:76:9e:13:73:ab:f0:48:c7:d6:
         0a:79:d9:17:94:aa:7d:c0:7c:c6:ba:7e:94:86:9c:49:15:61:
         6e:e1:d5:66:02:0a:08:06:a3:4c:9b:bd:ec:e9:c3:e8:56:ed:
         5c:56:4b:01:d1:84:20:d9:a7:3e:1c:7a:44:87:cb:c1:c6:59:
         6b:89:d0:65:c4:09:28:a9:cc:82:45:f8:bb:4d:5d:f9:82:73:
         a7:3b:fd:8c:45:64:a5:91:04:9f:80:7e:ce:0d:06:3f:44:db:
         4f:92:f9:bd:f5:7c:96:70:9f:13:49:4f:71:05:0b:61:91:bb:
         e4:77:ce:01:34:15:7f:b7:29:d2:11:bc:96:7e:8b:ce:40:c9:
         28:a4:f7:2a:54:b8:71:c2:53:db:9f:8f:77:90:06:ff:3a:59:
         fa:e7:02:98:df:42:4e:36:14:84:5b:35:fb:7c:95:a2:ef:44:
         62:28:35:06:c4:0e:87:4f:b5:b8:f0:28:3d:a4:8d:2a:7c:10:
         88:6e:d0:39:2d:9c:64:28:02:52:37:52:c4:78:7d:60:82:02:
         9f:44:d5:3b:d3:8c:fe:5d:67:14:66:57:b5:04:72:4b:0b:69:
         a8:09:91:79
-----BEGIN CERTIFICATE-----
MIIHMTCCBhmgAwIBAgIUEFjSOroZi0mU6R4qdCMLI1/QM3EwDQYJKoZIhvcNAQEL
BQAwMzExMC8GA1UEAxMoQzFBRjhDOTk5RTlEMDZEQURFQkMzODdENzhCMzA1QUI4
NzE2REMyRjAeFw0yMjAyMDkwNzM5NTVaFw0yMzAyMDkwNzQ0NTVaMIICLTGCAikw
ggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwOUM4MTE2MThDQjA2QzRDMzcy
RDIyMzFBQjEwQkZEMUY2RTJGQTQ1OUM1N0FCQUIwQzYzMkEyNDA5OEJERjhFREE2
OUZFNjRFMzJDODYyRjI2RUFCRUYyQkQ2QjZBOUFCOTM1MkFDNzFCQjVBNEUxMTBF
RTJFMjE5OEZCOEMxMzJENzAwQTk0MTI2MDcwQTBDQUJGMzk5OUQzOTY0NDNFRUY1
ODQ3ODI3OUFERUFFOEQxOUVEMjg4QUY5MERDMUJCODBGQ0ZCRTk5MUQwNTFFODA4
RDlGRENEOUEwODI2MTkxM0E2NjkzQTlDNDk0RTdEMzEzMUNEREYyNjJFRkYwQjJG
Njk5MDE2Qjk1QjIzODE5RDVDOUIwNjMwOTE2OTE0NTYzNjVDNDk1MTU0QzQ5NUMw
QTFDRTdBRUNCMjRGMTdFNDBFQjI5RDRBRkM1QzcwQUZBMjQ3RDY1QUZENDAzRENE
MzU5NDdFMDFDMDEyQ0M4MjU0M0U0QzY3NkY5RkYzNUQ5OERGNzRCNDJCODQ0MkU0
MTlBMUIzMEI3M0YxQkUwQjFFRDY3QkQ0MzI4MDYzNzk4MTkzM0U0RUMzMzYwMUFC
RDY3Njk4NTNBRDM1QjFDQTFGRjEyQjNFRjcxNDA2M0RDQUJFQjM5RkMxN0ZDRTAx
MTBCQzgwNTAzOThERkIwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAnIEWGMsGxMNy0iMasQv9H24vpFnFerqwxjKiQJi9+O2mn+ZOMshi
8m6r7yvWtqmrk1KscbtaThEO4uIZj7jBMtcAqUEmBwoMq/OZnTlkQ+71hHgnmt6u
jRntKIr5DcG7gPz76ZHQUegI2f3NmggmGROmaTqcSU59MTHN3yYu/wsvaZAWuVsj
gZ1cmwYwkWkUVjZcSVFUxJXAoc567LJPF+QOsp1K/Fxwr6JH1lr9QD3NNZR+AcAS
zIJUPkxnb5/zXZjfdLQrhELkGaGzC3Pxvgse1nvUMoBjeYGTPk7DNgGr1naYU601
scof8Ss+9xQGPcq+s5/Bf84BELyAUDmN+wIDAQABo4ICPzCCAjswHQYDVR0OBBYE
FPbd6QSjUVuMkSdUffaYXW6d3GCRMB8GA1UdIwQYMBaAFMGvjJmenQba3rw4fXiz
BauHFtwvMA4GA1UdDwEB/wQEAwIHgDCBhQYDVR0fBH4wfDB6oHigdoZ0cnN5bmM6
Ly9yZXBvLXJwa2kuaWRuaWMubmV0L3JlcG8vMTkyMDVlN2MtYTg4MS00ODczLTkx
ODgtZTUyMWI2YWY1MjljLzAvQzFBRjhDOTk5RTlEMDZEQURFQkMzODdENzhCMzA1
QUI4NzE2REMyRi5jcmwwdAYIKwYBBQUHAQEEaDBmMGQGCCsGAQUFBzAChlhyc3lu
YzovL3JlcG8tcnBraS5pZG5pYy5uZXQvcmVwby9JRE5JQy1JRC8yL0MxQUY4Qzk5
OUU5RDA2REFERUJDMzg3RDc4QjMwNUFCODcxNkRDMkYuY2VyMIGsBggrBgEFBQcB
CwSBnzCBnDCBmQYIKwYBBQUHMAuGgYxyc3luYzovL3JlcG8tcnBraS5pZG5pYy5u
ZXQvcmVwby8xOTIwNWU3Yy1hODgxLTQ4NzMtOTE4OC1lNTIxYjZhZjUyOWMvMC8z
MjM0MzAzMDNhNjQ2MzMwMzAzYTM0MzAzMDMyM2EzYTJmMzQzODJkMzQzODIwM2Qz
ZTIwMzEzMzMxMzEzMTMxLnJvYTAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCIG
CCsGAQUFBwEHAQH/BBMwETAPBAIAAjAJAwcAJADcAEACMA0GCSqGSIb3DQEBCwUA
A4IBAQBiQ89Hp41VAVuOcmblJwLIwTJQ/Xu2uhsSIE52nhNzq/BIx9YKedkXlKp9
wHzGun6UhpxJFWFu4dVmAgoIBqNMm73s6cPoVu1cVksB0YQg2ac+HHpEh8vBxllr
idBlxAkoqcyCRfi7TV35gnOnO/2MRWSlkQSfgH7ODQY/RNtPkvm99XyWcJ8TSU9x
BQthkbvkd84BNBV/tynSEbyWfovOQMkopPcqVLhxwlPbn493kAb/Oln65wKY30JO
NhSEWzX7fJWi70RiKDUGxA6HT7W48Cg9pI0qfBCIbtA5LZxkKAJSN1LEeH1gggKf
RNU704z+XWcUZle1BHJLC2moCZF5
-----END CERTIFICATE-----