Route Origin Authorization

$ rpki-client -vvf rpki-repo.registro.br/repo/Fyy9t7bAaY1SRtMjjkXwUMnEcxYueq65dZ9LaV1ND2yA/0/3138372e31392e302e302f32302d3230203d3e203238313234.roa
File:                     3138372e31392e302e302f32302d3230203d3e203238313234.roa (raw, json)
Hash identifier:          7NNVkreo6+kwvEGvwC+ziNRceS7m18pHtAOuYehAA6k=
Subject key identifier:   13:CC:B6:72:89:DE:C4:97:FE:95:36:C0:ED:2D:54:E1:B5:BC:C5:97
Certificate issuer:       /CN=AAB9B3905E93FDE63A41BF51929A3CADCCA064AB
Certificate serial:       2774056BFE200138B31F48241D38D8BDD736B744
Authority key identifier: AA:B9:B3:90:5E:93:FD:E6:3A:41:BF:51:92:9A:3C:AD:CC:A0:64:AB
Authority info access:    rsync://rpki-repo.registro.br/repo/nicbr_repo/0/AAB9B3905E93FDE63A41BF51929A3CADCCA064AB.cer
Subject info access:      rsync://rpki-repo.registro.br/repo/Fyy9t7bAaY1SRtMjjkXwUMnEcxYueq65dZ9LaV1ND2yA/0/3138372e31392e302e302f32302d3230203d3e203238313234.roa
Signing time:             Thu 02 Feb 2023 20:00:06 +0000
ROA not before:           Thu 02 Feb 2023 19:55:06 +0000
ROA not after:            Thu 01 Feb 2024 20:00:06 +0000
asID:                     28124
IP address blocks:        187.19.0.0/20 maxlen: 20

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            27:74:05:6b:fe:20:01:38:b3:1f:48:24:1d:38:d8:bd:d7:36:b7:44
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=AAB9B3905E93FDE63A41BF51929A3CADCCA064AB
        Validity
            Not Before: Feb  2 19:55:06 2023 GMT
            Not After : Feb  1 20:00:06 2024 GMT
        Subject: CN=3082010A0282010100ACF4FA51F74373FB8D7FA0A680CAF741D8AB147735AF1A817775614D4A8958CFDC662B0F4C2466D793BF74D311BA2C991EF94237A188FC1211F370AEBB030C77799E60AC674420BF9405275DFE3C5A50505F50804FACFF38B58E222B6F287E02F987A2269D538491A961E5D521585B80055E22F9DDF7E29AA0678A822C6A38BE0DBAB4C67E2513CCA18A449635B2AB7685D81B475CFF9163DEAE439C46C7282AFECBF2F516F912B80241F8C5E2178F012B94897BD3CA8A1667DCF3C4472324C9D81F56243C0DFF1D868CC40E159667E2D960D294AFCEF3E4149DC50808C2E1E6D8D710BB33CCC78E7B51267B0B4F7156DD6E95DCDB0D59CB1F654C251592A9C10203010001
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ac:f4:fa:51:f7:43:73:fb:8d:7f:a0:a6:80:ca:
                    f7:41:d8:ab:14:77:35:af:1a:81:77:75:61:4d:4a:
                    89:58:cf:dc:66:2b:0f:4c:24:66:d7:93:bf:74:d3:
                    11:ba:2c:99:1e:f9:42:37:a1:88:fc:12:11:f3:70:
                    ae:bb:03:0c:77:79:9e:60:ac:67:44:20:bf:94:05:
                    27:5d:fe:3c:5a:50:50:5f:50:80:4f:ac:ff:38:b5:
                    8e:22:2b:6f:28:7e:02:f9:87:a2:26:9d:53:84:91:
                    a9:61:e5:d5:21:58:5b:80:05:5e:22:f9:dd:f7:e2:
                    9a:a0:67:8a:82:2c:6a:38:be:0d:ba:b4:c6:7e:25:
                    13:cc:a1:8a:44:96:35:b2:ab:76:85:d8:1b:47:5c:
                    ff:91:63:de:ae:43:9c:46:c7:28:2a:fe:cb:f2:f5:
                    16:f9:12:b8:02:41:f8:c5:e2:17:8f:01:2b:94:89:
                    7b:d3:ca:8a:16:67:dc:f3:c4:47:23:24:c9:d8:1f:
                    56:24:3c:0d:ff:1d:86:8c:c4:0e:15:96:67:e2:d9:
                    60:d2:94:af:ce:f3:e4:14:9d:c5:08:08:c2:e1:e6:
                    d8:d7:10:bb:33:cc:c7:8e:7b:51:26:7b:0b:4f:71:
                    56:dd:6e:95:dc:db:0d:59:cb:1f:65:4c:25:15:92:
                    a9:c1
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                13:CC:B6:72:89:DE:C4:97:FE:95:36:C0:ED:2D:54:E1:B5:BC:C5:97
            X509v3 Authority Key Identifier:
                keyid:AA:B9:B3:90:5E:93:FD:E6:3A:41:BF:51:92:9A:3C:AD:CC:A0:64:AB

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki-repo.registro.br/repo/Fyy9t7bAaY1SRtMjjkXwUMnEcxYueq65dZ9LaV1ND2yA/0/AAB9B3905E93FDE63A41BF51929A3CADCCA064AB.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki-repo.registro.br/repo/nicbr_repo/0/AAB9B3905E93FDE63A41BF51929A3CADCCA064AB.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki-repo.registro.br/repo/Fyy9t7bAaY1SRtMjjkXwUMnEcxYueq65dZ9LaV1ND2yA/0/3138372e31392e302e302f32302d3230203d3e203238313234.roa

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv4:
                  187.19.0.0/20

    Signature Algorithm: sha256WithRSAEncryption
         30:67:6b:25:2f:71:14:09:6c:cf:c5:a8:02:1b:3a:17:20:78:
         37:22:17:c9:70:7f:dc:21:38:df:00:0e:34:40:3f:2e:bf:5d:
         c4:c2:31:0d:5e:68:99:35:89:22:a4:ea:a9:5d:2b:04:e4:cc:
         2d:d6:3e:8c:37:c0:cb:4a:aa:f6:24:22:5f:12:5d:3b:92:8e:
         ca:ad:0a:27:5b:1b:ea:a9:7d:53:f1:be:c3:77:52:8d:98:b8:
         1f:d5:1c:33:8f:37:cd:d1:37:96:37:10:02:f3:28:e8:10:13:
         68:b8:4a:64:54:fe:ec:ff:64:a4:c2:f5:c1:34:99:12:1e:e2:
         9d:ba:04:a7:9d:a5:3b:f0:73:76:89:d5:b0:2f:24:a9:3a:17:
         41:25:dc:93:7e:54:ae:14:08:63:c7:de:02:e7:10:f3:81:e1:
         fe:ad:31:f3:23:0e:88:c2:6e:08:21:48:23:dd:ef:c0:78:c3:
         29:22:98:79:cc:87:77:06:39:92:c1:4e:89:f0:50:ad:15:84:
         f1:eb:b1:ac:42:dd:72:0f:78:71:15:0b:ed:f3:12:1a:10:86:
         eb:f4:0e:70:5f:a3:11:44:46:81:92:6c:24:cd:15:f1:21:08:
         e1:51:d7:51:62:3a:25:03:f6:d4:27:77:12:b9:2f:d7:08:56:
         f9:18:cf:eb
-----BEGIN CERTIFICATE-----
MIIHPTCCBiWgAwIBAgIUJ3QFa/4gATizH0gkHTjYvdc2t0QwDQYJKoZIhvcNAQEL
BQAwMzExMC8GA1UEAxMoQUFCOUIzOTA1RTkzRkRFNjNBNDFCRjUxOTI5QTNDQURD
Q0EwNjRBQjAeFw0yMzAyMDIxOTU1MDZaFw0yNDAyMDEyMDAwMDZaMIICLTGCAikw
ggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQUNGNEZBNTFGNzQzNzNGQjhE
N0ZBMEE2ODBDQUY3NDFEOEFCMTQ3NzM1QUYxQTgxNzc3NTYxNEQ0QTg5NThDRkRD
NjYyQjBGNEMyNDY2RDc5M0JGNzREMzExQkEyQzk5MUVGOTQyMzdBMTg4RkMxMjEx
RjM3MEFFQkIwMzBDNzc3OTlFNjBBQzY3NDQyMEJGOTQwNTI3NURGRTNDNUE1MDUw
NUY1MDgwNEZBQ0ZGMzhCNThFMjIyQjZGMjg3RTAyRjk4N0EyMjY5RDUzODQ5MUE5
NjFFNUQ1MjE1ODVCODAwNTVFMjJGOURERjdFMjlBQTA2NzhBODIyQzZBMzhCRTBE
QkFCNEM2N0UyNTEzQ0NBMThBNDQ5NjM1QjJBQjc2ODVEODFCNDc1Q0ZGOTE2M0RF
QUU0MzlDNDZDNzI4MkFGRUNCRjJGNTE2RjkxMkI4MDI0MUY4QzVFMjE3OEYwMTJC
OTQ4OTdCRDNDQThBMTY2N0RDRjNDNDQ3MjMyNEM5RDgxRjU2MjQzQzBERkYxRDg2
OENDNDBFMTU5NjY3RTJEOTYwRDI5NEFGQ0VGM0U0MTQ5REM1MDgwOEMyRTFFNkQ4
RDcxMEJCMzNDQ0M3OEU3QjUxMjY3QjBCNEY3MTU2REQ2RTk1RENEQjBENTlDQjFG
NjU0QzI1MTU5MkE5QzEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEArPT6UfdDc/uNf6CmgMr3QdirFHc1rxqBd3VhTUqJWM/cZisPTCRm
15O/dNMRuiyZHvlCN6GI/BIR83CuuwMMd3meYKxnRCC/lAUnXf48WlBQX1CAT6z/
OLWOIitvKH4C+YeiJp1ThJGpYeXVIVhbgAVeIvnd9+KaoGeKgixqOL4NurTGfiUT
zKGKRJY1sqt2hdgbR1z/kWPerkOcRscoKv7L8vUW+RK4AkH4xeIXjwErlIl708qK
Fmfc88RHIyTJ2B9WJDwN/x2GjMQOFZZn4tlg0pSvzvPkFJ3FCAjC4ebY1xC7M8zH
jntRJnsLT3FW3W6V3NsNWcsfZUwlFZKpwQIDAQABo4ICSzCCAkcwHQYDVR0OBBYE
FBPMtnKJ3sSX/pU2wO0tVOG1vMWXMB8GA1UdIwQYMBaAFKq5s5Bek/3mOkG/UZKa
PK3MoGSrMA4GA1UdDwEB/wQEAwIHgDCBlAYDVR0fBIGMMIGJMIGGoIGDoIGAhn5y
c3luYzovL3Jwa2ktcmVwby5yZWdpc3Ryby5ici9yZXBvL0Z5eTl0N2JBYVkxU1J0
TWpqa1h3VU1uRWN4WXVlcTY1ZFo5TGFWMU5EMnlBLzAvQUFCOUIzOTA1RTkzRkRF
NjNBNDFCRjUxOTI5QTNDQURDQ0EwNjRBQi5jcmwweAYIKwYBBQUHAQEEbDBqMGgG
CCsGAQUFBzAChlxyc3luYzovL3Jwa2ktcmVwby5yZWdpc3Ryby5ici9yZXBvL25p
Y2JyX3JlcG8vMC9BQUI5QjM5MDVFOTNGREU2M0E0MUJGNTE5MjlBM0NBRENDQTA2
NEFCLmNlcjCBqAYIKwYBBQUHAQsEgZswgZgwgZUGCCsGAQUFBzALhoGIcnN5bmM6
Ly9ycGtpLXJlcG8ucmVnaXN0cm8uYnIvcmVwby9GeXk5dDdiQWFZMVNSdE1qamtY
d1VNbkVjeFl1ZXE2NWRaOUxhVjFORDJ5QS8wLzMxMzgzNzJlMzEzOTJlMzAyZTMw
MmYzMjMwMmQzMjMwMjAzZDNlMjAzMjM4MzEzMjM0LnJvYTAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMB8GCCsGAQUFBwEHAQH/BBAwDjAMBAIAATAGAwQEuxMAMA0G
CSqGSIb3DQEBCwUAA4IBAQAwZ2slL3EUCWzPxagCGzoXIHg3IhfJcH/cITjfAA40
QD8uv13EwjENXmiZNYkipOqpXSsE5Mwt1j6MN8DLSqr2JCJfEl07ko7KrQonWxvq
qX1T8b7Dd1KNmLgf1RwzjzfN0TeWNxAC8yjoEBNouEpkVP7s/2SkwvXBNJkSHuKd
ugSnnaU78HN2idWwLySpOhdBJdyTflSuFAhjx94C5xDzgeH+rTHzIw6Iwm4IIUgj
3e/AeMMpIph5zId3BjmSwU6J8FCtFYTx67GsQt1yD3hxFQvt8xIaEIbr9A5wX6MR
REaBkmwkzRXxIQjhUddRYjolA/bUJ3cSuS/XCFb5GM/r
-----END CERTIFICATE-----