Route Origin Authorization

$ rpki-client -vvf repo-rpki.idnic.net/repo/IDNIC-ID/2/3230332e3139342e3131322e302f32322d3234203d3e203538343837.roa
File:                     3230332e3139342e3131322e302f32322d3234203d3e203538343837.roa (raw, json)
Hash identifier:          d94oln7OnbKEPxlPbCCSsRGE0tLrm2Oyb+HN/L/TT0U=
Subject key identifier:   54:CC:D8:4E:4C:8F:E0:1C:34:02:ED:2A:BF:8C:5E:E4:77:96:BF:DA
Certificate issuer:       /CN=A91862140000/serialNumber=BA8F77D21E58FE9C939A6B70E2585617E183376B
Certificate serial:       3FFC341D774CBA74262320339E1AB370790BC879
Authority key identifier: BA:8F:77:D2:1E:58:FE:9C:93:9A:6B:70:E2:58:56:17:E1:83:37:6B
Authority info access:    rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/uo930h5Y_pyTmmtw4lhWF-GDN2s.cer
Subject info access:      rsync://repo-rpki.idnic.net/repo/IDNIC-ID/2/3230332e3139342e3131322e302f32322d3234203d3e203538343837.roa
Signing time:             Wed 21 Apr 2021 03:17:38 +0000
ROA not before:           Wed 21 Apr 2021 03:12:38 +0000
ROA not after:            Thu 21 Apr 2022 03:17:38 +0000
asID:                     58487
IP address blocks:        203.194.112.0/22 maxlen: 24

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            3f:fc:34:1d:77:4c:ba:74:26:23:20:33:9e:1a:b3:70:79:0b:c8:79
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=A91862140000/serialNumber=BA8F77D21E58FE9C939A6B70E2585617E183376B
        Validity
            Not Before: Apr 21 03:12:38 2021 GMT
            Not After : Apr 21 03:17:38 2022 GMT
        Subject: CN=3082010A0282010100BD518BE3C324F52CB5179B4530D5D374B9A533FA8C6CDFC593EEF018C604FF67061EE06CD9227D389040CDA1DAD3D8219A96167C6AF12F3B9621161A547F7428975B831FA5ADF8BFADE86A7D1C6A0074DA7800F59B2A75AC612D4F867C6A6B6771D7D432F732841346DF0D78971B01AF4717EA250598B74608D0F4C21D89A52CBD7E56F70ABC11A361CC5D53CC4C41722605FB1A4A04DEAE524D5BF9C3A61CC23F448E8B7CF94F774687BF96A15FDD62CF353671F6CB12AFE34044FB33732C3A563B50F3C5C99575FB3BCA19BBF0B94D6E972097994604F8A611F92324C082BB589E3CAE0F1906EF1A5D1CCB70CCA23380E520449E8337172DC42B4CDD587CC10203010001
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:bd:51:8b:e3:c3:24:f5:2c:b5:17:9b:45:30:d5:
                    d3:74:b9:a5:33:fa:8c:6c:df:c5:93:ee:f0:18:c6:
                    04:ff:67:06:1e:e0:6c:d9:22:7d:38:90:40:cd:a1:
                    da:d3:d8:21:9a:96:16:7c:6a:f1:2f:3b:96:21:16:
                    1a:54:7f:74:28:97:5b:83:1f:a5:ad:f8:bf:ad:e8:
                    6a:7d:1c:6a:00:74:da:78:00:f5:9b:2a:75:ac:61:
                    2d:4f:86:7c:6a:6b:67:71:d7:d4:32:f7:32:84:13:
                    46:df:0d:78:97:1b:01:af:47:17:ea:25:05:98:b7:
                    46:08:d0:f4:c2:1d:89:a5:2c:bd:7e:56:f7:0a:bc:
                    11:a3:61:cc:5d:53:cc:4c:41:72:26:05:fb:1a:4a:
                    04:de:ae:52:4d:5b:f9:c3:a6:1c:c2:3f:44:8e:8b:
                    7c:f9:4f:77:46:87:bf:96:a1:5f:dd:62:cf:35:36:
                    71:f6:cb:12:af:e3:40:44:fb:33:73:2c:3a:56:3b:
                    50:f3:c5:c9:95:75:fb:3b:ca:19:bb:f0:b9:4d:6e:
                    97:20:97:99:46:04:f8:a6:11:f9:23:24:c0:82:bb:
                    58:9e:3c:ae:0f:19:06:ef:1a:5d:1c:cb:70:cc:a2:
                    33:80:e5:20:44:9e:83:37:17:2d:c4:2b:4c:dd:58:
                    7c:c1
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                54:CC:D8:4E:4C:8F:E0:1C:34:02:ED:2A:BF:8C:5E:E4:77:96:BF:DA
            X509v3 Authority Key Identifier:
                keyid:BA:8F:77:D2:1E:58:FE:9C:93:9A:6B:70:E2:58:56:17:E1:83:37:6B

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://repo-rpki.idnic.net/repo/IDNIC-ID/2/BA8F77D21E58FE9C939A6B70E2585617E183376B.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/uo930h5Y_pyTmmtw4lhWF-GDN2s.cer

            Subject Information Access:
                Signed Object - URI:rsync://repo-rpki.idnic.net/repo/IDNIC-ID/2/3230332e3139342e3131322e302f32322d3234203d3e203538343837.roa

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv4:
                  203.194.112.0/22

    Signature Algorithm: sha256WithRSAEncryption
         39:9b:d1:62:b4:59:50:2a:2d:cb:c3:10:c1:45:5c:40:b9:09:
         d7:c1:bb:1f:a1:10:44:ae:6b:b8:78:38:a0:bd:f4:b8:45:a9:
         1f:c6:ae:40:f5:26:1e:c0:4d:9a:52:d5:22:65:39:f5:f3:96:
         63:43:98:dc:6f:ac:a3:b1:ae:9d:ff:48:08:2b:72:f7:fc:41:
         93:d5:5a:12:c6:8e:ed:13:0b:9e:c2:ff:a5:dc:d2:26:16:6c:
         7a:8b:38:56:ec:b7:59:24:dc:1b:39:b1:8a:24:fd:97:bd:1a:
         5d:4c:53:09:2c:39:aa:65:a8:73:8d:a8:f3:86:45:70:35:ff:
         cc:7f:6e:7c:fe:ee:22:9c:64:e4:a7:78:39:eb:4c:da:46:14:
         9a:69:3e:c3:bd:3b:35:ad:28:8d:41:36:75:b8:7f:c5:60:5d:
         b2:6f:a8:8f:8a:70:08:ca:7d:f0:1c:36:0a:24:be:e1:19:2f:
         4e:8d:60:55:c7:cf:b1:ca:1a:d2:0b:d5:a3:1a:d0:64:68:ce:
         a7:ad:9c:c1:c1:8b:75:8d:e5:d8:b9:16:17:43:66:35:80:48:
         3d:c1:5e:ef:82:15:0e:e1:3c:dd:b5:0a:17:4b:d7:e1:e0:30:
         6e:ce:0c:b2:28:14:1e:2d:30:83:78:2f:d3:82:af:a0:78:94:
         0c:f4:89:c4
-----BEGIN CERTIFICATE-----
MIIHCjCCBfKgAwIBAgIUP/w0HXdMunQmIyAznhqzcHkLyHkwDQYJKoZIhvcNAQEL
BQAwSjEVMBMGA1UEAxMMQTkxODYyMTQwMDAwMTEwLwYDVQQFEyhCQThGNzdEMjFF
NThGRTlDOTM5QTZCNzBFMjU4NTYxN0UxODMzNzZCMB4XDTIxMDQyMTAzMTIzOFoX
DTIyMDQyMTAzMTczOFowggItMYICKTCCAiUGA1UEAxOCAhwzMDgyMDEwQTAyODIw
MTAxMDBCRDUxOEJFM0MzMjRGNTJDQjUxNzlCNDUzMEQ1RDM3NEI5QTUzM0ZBOEM2
Q0RGQzU5M0VFRjAxOEM2MDRGRjY3MDYxRUUwNkNEOTIyN0QzODkwNDBDREExREFE
M0Q4MjE5QTk2MTY3QzZBRjEyRjNCOTYyMTE2MUE1NDdGNzQyODk3NUI4MzFGQTVB
REY4QkZBREU4NkE3RDFDNkEwMDc0REE3ODAwRjU5QjJBNzVBQzYxMkQ0Rjg2N0M2
QTZCNjc3MUQ3RDQzMkY3MzI4NDEzNDZERjBENzg5NzFCMDFBRjQ3MTdFQTI1MDU5
OEI3NDYwOEQwRjRDMjFEODlBNTJDQkQ3RTU2RjcwQUJDMTFBMzYxQ0M1RDUzQ0M0
QzQxNzIyNjA1RkIxQTRBMDRERUFFNTI0RDVCRjlDM0E2MUNDMjNGNDQ4RThCN0NG
OTRGNzc0Njg3QkY5NkExNUZERDYyQ0YzNTM2NzFGNkNCMTJBRkUzNDA0NEZCMzM3
MzJDM0E1NjNCNTBGM0M1Qzk5NTc1RkIzQkNBMTlCQkYwQjk0RDZFOTcyMDk3OTk0
NjA0RjhBNjExRjkyMzI0QzA4MkJCNTg5RTNDQUUwRjE5MDZFRjFBNUQxQ0NCNzBD
Q0EyMzM4MEU1MjA0NDlFODMzNzE3MkRDNDJCNENERDU4N0NDMTAyMDMwMTAwMDEw
ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC9UYvjwyT1LLUXm0Uw1dN0
uaUz+oxs38WT7vAYxgT/ZwYe4GzZIn04kEDNodrT2CGalhZ8avEvO5YhFhpUf3Qo
l1uDH6Wt+L+t6Gp9HGoAdNp4APWbKnWsYS1Phnxqa2dx19Qy9zKEE0bfDXiXGwGv
RxfqJQWYt0YI0PTCHYmlLL1+VvcKvBGjYcxdU8xMQXImBfsaSgTerlJNW/nDphzC
P0SOi3z5T3dGh7+WoV/dYs81NnH2yxKv40BE+zNzLDpWO1DzxcmVdfs7yhm78LlN
bpcgl5lGBPimEfkjJMCCu1iePK4PGQbvGl0cy3DMojOA5SBEnoM3Fy3EK0zdWHzB
AgMBAAGjggIBMIIB/TAdBgNVHQ4EFgQUVMzYTkyP4Bw0Au0qv4xe5HeWv9owHwYD
VR0jBBgwFoAUuo930h5Y/pyTmmtw4lhWF+GDN2swDgYDVR0PAQH/BAQDAgeAMGkG
A1UdHwRiMGAwXqBcoFqGWHJzeW5jOi8vcmVwby1ycGtpLmlkbmljLm5ldC9yZXBv
L0lETklDLUlELzIvQkE4Rjc3RDIxRTU4RkU5QzkzOUE2QjcwRTI1ODU2MTdFMTgz
Mzc2Qi5jcmwwfgYIKwYBBQUHAQEEcjBwMG4GCCsGAQUFBzAChmJyc3luYzovL3Jw
a2kuYXBuaWMubmV0L3JlcG9zaXRvcnkvQjUyN0VGNTgxRDY2MTFFMkJCNDY4RjdD
NzJGRDFGRjIvdW85MzBoNVlfcHlUbW10dzRsaFdGLUdETjJzLmNlcjCBhAYIKwYB
BQUHAQsEeDB2MHQGCCsGAQUFBzALhmhyc3luYzovL3JlcG8tcnBraS5pZG5pYy5u
ZXQvcmVwby9JRE5JQy1JRC8yLzMyMzAzMzJlMzEzOTM0MmUzMTMxMzIyZTMwMmYz
MjMyMmQzMjM0MjAzZDNlMjAzNTM4MzQzODM3LnJvYTAYBgNVHSABAf8EDjAMMAoG
CCsGAQUFBw4CMB8GCCsGAQUFBwEHAQH/BBAwDjAMBAIAATAGAwQCy8JwMA0GCSqG
SIb3DQEBCwUAA4IBAQA5m9FitFlQKi3LwxDBRVxAuQnXwbsfoRBErmu4eDigvfS4
Rakfxq5A9SYewE2aUtUiZTn185ZjQ5jcb6yjsa6d/0gIK3L3/EGT1VoSxo7tEwue
wv+l3NImFmx6izhW7LdZJNwbObGKJP2XvRpdTFMJLDmqZahzjajzhkVwNf/Mf258
/u4inGTkp3g560zaRhSaaT7DvTs1rSiNQTZ1uH/FYF2yb6iPinAIyn3wHDYKJL7h
GS9OjWBVx8+xyhrSC9WjGtBkaM6nrZzBwYt1jeXYuRYXQ2Y1gEg9wV7vghUO4Tzd
tQoXS9fh4DBuzgyyKBQeLTCDeC/Tgq+geJQM9InE
-----END CERTIFICATE-----