Route Origin Authorization

$ rpki-client -vvf repo-rpki.idnic.net/repo/19205e7c-a881-4873-9188-e521b6af529c/0/323430303a646330303a633030303a3a2f34382d3438203d3e20313331313131.roa
File:                     323430303a646330303a633030303a3a2f34382d3438203d3e20313331313131.roa (raw, json)
Hash identifier:          +oBuv5u/qkZuWHFzSQoaC/g+ksqowcPYc2yE/aL/Id8=
Subject key identifier:   D2:C9:EA:DE:3D:9B:8A:35:0A:70:28:7C:9D:66:7B:5F:43:22:C2:8B
Certificate issuer:       /CN=C1AF8C999E9D06DADEBC387D78B305AB8716DC2F
Certificate serial:       380DEBBD864F2A66E28C5DAC5B4355B416810D34
Authority key identifier: C1:AF:8C:99:9E:9D:06:DA:DE:BC:38:7D:78:B3:05:AB:87:16:DC:2F
Authority info access:    rsync://repo-rpki.idnic.net/repo/IDNIC-ID/2/C1AF8C999E9D06DADEBC387D78B305AB8716DC2F.cer
Subject info access:      rsync://repo-rpki.idnic.net/repo/19205e7c-a881-4873-9188-e521b6af529c/0/323430303a646330303a633030303a3a2f34382d3438203d3e20313331313131.roa
Signing time:             Thu 03 Feb 2022 03:00:48 +0000
ROA not before:           Thu 03 Feb 2022 02:55:48 +0000
ROA not after:            Fri 03 Feb 2023 03:00:48 +0000
asID:                     131111
IP address blocks:        2400:dc00:c000::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            38:0d:eb:bd:86:4f:2a:66:e2:8c:5d:ac:5b:43:55:b4:16:81:0d:34
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=C1AF8C999E9D06DADEBC387D78B305AB8716DC2F
        Validity
            Not Before: Feb  3 02:55:48 2022 GMT
            Not After : Feb  3 03:00:48 2023 GMT
        Subject: CN=3082010A0282010100B7E56D37D95FFBC15206FFA64E628D29A2BC2EBFF882DB42304258555D9C733A6A604F1563D35EEB1295EE43AA3F62A7D9E3DFB2F8449D4A23D1CF68213F6100836E5951C4806DCD524B899E71085292C0F21112B9257E976DAD7D9AFCB62D22D5158A6D0C47DF29FC645AEC8BF30B0229FCECBE41E7B9487DDE5942F0080E06210A2071FA9279BC2815250755F0879B9F3783F3B0BBC97AFC689E4057A76B86F6E9AAE5C02CB43797BB437F73485924A6A8300E4F1FAB14A25E44C31F4E0C825231A6C943451C2DC1F6E121F75763499CBE278D9C501D2D0CBF7937E1303EA037ABA71E3A680FD6BD75A2DD397E2EE5A128F6B3E391976B7D5388E36BA17CC10203010001
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b7:e5:6d:37:d9:5f:fb:c1:52:06:ff:a6:4e:62:
                    8d:29:a2:bc:2e:bf:f8:82:db:42:30:42:58:55:5d:
                    9c:73:3a:6a:60:4f:15:63:d3:5e:eb:12:95:ee:43:
                    aa:3f:62:a7:d9:e3:df:b2:f8:44:9d:4a:23:d1:cf:
                    68:21:3f:61:00:83:6e:59:51:c4:80:6d:cd:52:4b:
                    89:9e:71:08:52:92:c0:f2:11:12:b9:25:7e:97:6d:
                    ad:7d:9a:fc:b6:2d:22:d5:15:8a:6d:0c:47:df:29:
                    fc:64:5a:ec:8b:f3:0b:02:29:fc:ec:be:41:e7:b9:
                    48:7d:de:59:42:f0:08:0e:06:21:0a:20:71:fa:92:
                    79:bc:28:15:25:07:55:f0:87:9b:9f:37:83:f3:b0:
                    bb:c9:7a:fc:68:9e:40:57:a7:6b:86:f6:e9:aa:e5:
                    c0:2c:b4:37:97:bb:43:7f:73:48:59:24:a6:a8:30:
                    0e:4f:1f:ab:14:a2:5e:44:c3:1f:4e:0c:82:52:31:
                    a6:c9:43:45:1c:2d:c1:f6:e1:21:f7:57:63:49:9c:
                    be:27:8d:9c:50:1d:2d:0c:bf:79:37:e1:30:3e:a0:
                    37:ab:a7:1e:3a:68:0f:d6:bd:75:a2:dd:39:7e:2e:
                    e5:a1:28:f6:b3:e3:91:97:6b:7d:53:88:e3:6b:a1:
                    7c:c1
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D2:C9:EA:DE:3D:9B:8A:35:0A:70:28:7C:9D:66:7B:5F:43:22:C2:8B
            X509v3 Authority Key Identifier:
                keyid:C1:AF:8C:99:9E:9D:06:DA:DE:BC:38:7D:78:B3:05:AB:87:16:DC:2F

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://repo-rpki.idnic.net/repo/19205e7c-a881-4873-9188-e521b6af529c/0/C1AF8C999E9D06DADEBC387D78B305AB8716DC2F.crl

            Authority Information Access:
                CA Issuers - URI:rsync://repo-rpki.idnic.net/repo/IDNIC-ID/2/C1AF8C999E9D06DADEBC387D78B305AB8716DC2F.cer

            Subject Information Access:
                Signed Object - URI:rsync://repo-rpki.idnic.net/repo/19205e7c-a881-4873-9188-e521b6af529c/0/323430303a646330303a633030303a3a2f34382d3438203d3e20313331313131.roa

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv6:
                  2400:dc00:c000::/48

    Signature Algorithm: sha256WithRSAEncryption
         60:d2:82:3e:74:00:50:99:a3:61:58:9b:d7:19:5e:3f:fb:6b:
         99:e7:61:f2:e5:13:32:2f:af:fe:09:91:dd:18:99:2b:f7:5e:
         26:35:46:63:51:f9:1e:37:94:8d:af:2b:61:a2:5d:f9:c6:da:
         8b:fa:1a:cc:d7:7c:ec:62:35:37:75:06:10:15:57:8a:a8:6c:
         18:57:47:c1:46:1d:d6:d4:f1:9d:f6:b2:d0:67:0e:7b:7b:da:
         4e:f4:6b:3d:dd:bd:17:b1:9d:c1:4f:3a:4a:c9:79:e1:af:90:
         ef:c2:25:70:b6:36:1c:9c:e4:87:ce:2f:04:79:4c:88:e3:43:
         f0:52:47:af:ba:8f:f1:0d:ee:07:45:0c:ae:21:2b:d0:b2:9b:
         df:0d:b5:94:2c:2a:b3:8d:3d:cc:59:20:13:81:6f:e3:18:f9:
         ee:e9:59:a2:71:a2:6c:3d:81:75:63:bd:00:b1:01:99:89:ed:
         63:d5:9c:93:9a:f5:de:f2:aa:49:cd:e0:e2:22:67:2e:fd:33:
         63:2e:c7:68:69:ef:5f:4a:cf:a5:ca:c4:cf:7e:2e:1a:b0:6b:
         90:11:f4:01:d7:25:b7:d9:b4:99:cf:3d:ab:bb:05:dd:f2:b1:
         ff:9f:82:ad:3e:20:c1:42:5b:41:a5:5a:b8:dd:da:7b:7f:78:
         35:fb:de:1e
-----BEGIN CERTIFICATE-----
MIIHMTCCBhmgAwIBAgIUOA3rvYZPKmbijF2sW0NVtBaBDTQwDQYJKoZIhvcNAQEL
BQAwMzExMC8GA1UEAxMoQzFBRjhDOTk5RTlEMDZEQURFQkMzODdENzhCMzA1QUI4
NzE2REMyRjAeFw0yMjAyMDMwMjU1NDhaFw0yMzAyMDMwMzAwNDhaMIICLTGCAikw
ggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQjdFNTZEMzdEOTVGRkJDMTUy
MDZGRkE2NEU2MjhEMjlBMkJDMkVCRkY4ODJEQjQyMzA0MjU4NTU1RDlDNzMzQTZB
NjA0RjE1NjNEMzVFRUIxMjk1RUU0M0FBM0Y2MkE3RDlFM0RGQjJGODQ0OUQ0QTIz
RDFDRjY4MjEzRjYxMDA4MzZFNTk1MUM0ODA2RENENTI0Qjg5OUU3MTA4NTI5MkMw
RjIxMTEyQjkyNTdFOTc2REFEN0Q5QUZDQjYyRDIyRDUxNThBNkQwQzQ3REYyOUZD
NjQ1QUVDOEJGMzBCMDIyOUZDRUNCRTQxRTdCOTQ4N0RERTU5NDJGMDA4MEUwNjIx
MEEyMDcxRkE5Mjc5QkMyODE1MjUwNzU1RjA4NzlCOUYzNzgzRjNCMEJCQzk3QUZD
Njg5RTQwNTdBNzZCODZGNkU5QUFFNUMwMkNCNDM3OTdCQjQzN0Y3MzQ4NTkyNEE2
QTgzMDBFNEYxRkFCMTRBMjVFNDRDMzFGNEUwQzgyNTIzMUE2Qzk0MzQ1MUMyREMx
RjZFMTIxRjc1NzYzNDk5Q0JFMjc4RDlDNTAxRDJEMENCRjc5MzdFMTMwM0VBMDM3
QUJBNzFFM0E2ODBGRDZCRDc1QTJERDM5N0UyRUU1QTEyOEY2QjNFMzkxOTc2QjdE
NTM4OEUzNkJBMTdDQzEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAt+VtN9lf+8FSBv+mTmKNKaK8Lr/4gttCMEJYVV2cczpqYE8VY9Ne
6xKV7kOqP2Kn2ePfsvhEnUoj0c9oIT9hAINuWVHEgG3NUkuJnnEIUpLA8hESuSV+
l22tfZr8ti0i1RWKbQxH3yn8ZFrsi/MLAin87L5B57lIfd5ZQvAIDgYhCiBx+pJ5
vCgVJQdV8IebnzeD87C7yXr8aJ5AV6drhvbpquXALLQ3l7tDf3NIWSSmqDAOTx+r
FKJeRMMfTgyCUjGmyUNFHC3B9uEh91djSZy+J42cUB0tDL95N+EwPqA3q6ceOmgP
1r11ot05fi7loSj2s+ORl2t9U4jja6F8wQIDAQABo4ICPzCCAjswHQYDVR0OBBYE
FNLJ6t49m4o1CnAofJ1me19DIsKLMB8GA1UdIwQYMBaAFMGvjJmenQba3rw4fXiz
BauHFtwvMA4GA1UdDwEB/wQEAwIHgDCBhQYDVR0fBH4wfDB6oHigdoZ0cnN5bmM6
Ly9yZXBvLXJwa2kuaWRuaWMubmV0L3JlcG8vMTkyMDVlN2MtYTg4MS00ODczLTkx
ODgtZTUyMWI2YWY1MjljLzAvQzFBRjhDOTk5RTlEMDZEQURFQkMzODdENzhCMzA1
QUI4NzE2REMyRi5jcmwwdAYIKwYBBQUHAQEEaDBmMGQGCCsGAQUFBzAChlhyc3lu
YzovL3JlcG8tcnBraS5pZG5pYy5uZXQvcmVwby9JRE5JQy1JRC8yL0MxQUY4Qzk5
OUU5RDA2REFERUJDMzg3RDc4QjMwNUFCODcxNkRDMkYuY2VyMIGsBggrBgEFBQcB
CwSBnzCBnDCBmQYIKwYBBQUHMAuGgYxyc3luYzovL3JlcG8tcnBraS5pZG5pYy5u
ZXQvcmVwby8xOTIwNWU3Yy1hODgxLTQ4NzMtOTE4OC1lNTIxYjZhZjUyOWMvMC8z
MjM0MzAzMDNhNjQ2MzMwMzAzYTYzMzAzMDMwM2EzYTJmMzQzODJkMzQzODIwM2Qz
ZTIwMzEzMzMxMzEzMTMxLnJvYTAYBgNVHSABAf8EDjAMMAoGCCsGAQUFBw4CMCIG
CCsGAQUFBwEHAQH/BBMwETAPBAIAAjAJAwcAJADcAMAAMA0GCSqGSIb3DQEBCwUA
A4IBAQBg0oI+dABQmaNhWJvXGV4/+2uZ52Hy5RMyL6/+CZHdGJkr914mNUZjUfke
N5SNrythol35xtqL+hrM13zsYjU3dQYQFVeKqGwYV0fBRh3W1PGd9rLQZw57e9pO
9Gs93b0XsZ3BTzpKyXnhr5DvwiVwtjYcnOSHzi8EeUyI40PwUkevuo/xDe4HRQyu
ISvQspvfDbWULCqzjT3MWSATgW/jGPnu6VmicaJsPYF1Y70AsQGZie1j1ZyTmvXe
8qpJzeDiImcu/TNjLsdoae9fSs+lysTPfi4asGuQEfQB1yW32bSZzz2ruwXd8rH/
n4KtPiDBQltBpVq43dp7f3g1+94e
-----END CERTIFICATE-----