Route Origin Authorization

$ rpki-client -vvf rpki-repo.registro.br/repo/Fyy9t7bAaY1SRtMjjkXwUMnEcxYueq65dZ9LaV1ND2yA/0/3138372e31392e382e302f32312d3231203d3e203238313234.roa
File:                     3138372e31392e382e302f32312d3231203d3e203238313234.roa (raw, json)
Hash identifier:          7zK0ItGmcjEpOoYHCHLZcbaJVACWrUShNjx7Wpm8DaA=
Subject key identifier:   BD:D4:DC:13:A9:62:3B:57:51:4D:50:C0:F9:AF:40:C2:C1:87:D7:79
Certificate issuer:       /CN=AAB9B3905E93FDE63A41BF51929A3CADCCA064AB
Certificate serial:       463600B5A9B1B3FD8425D43516939AF333A70EE5
Authority key identifier: AA:B9:B3:90:5E:93:FD:E6:3A:41:BF:51:92:9A:3C:AD:CC:A0:64:AB
Authority info access:    rsync://rpki-repo.registro.br/repo/nicbr_repo/0/AAB9B3905E93FDE63A41BF51929A3CADCCA064AB.cer
Subject info access:      rsync://rpki-repo.registro.br/repo/Fyy9t7bAaY1SRtMjjkXwUMnEcxYueq65dZ9LaV1ND2yA/0/3138372e31392e382e302f32312d3231203d3e203238313234.roa
Signing time:             Thu 02 Feb 2023 20:00:03 +0000
ROA not before:           Thu 02 Feb 2023 19:55:03 +0000
ROA not after:            Thu 01 Feb 2024 20:00:03 +0000
asID:                     28124
IP address blocks:        187.19.8.0/21 maxlen: 21

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            46:36:00:b5:a9:b1:b3:fd:84:25:d4:35:16:93:9a:f3:33:a7:0e:e5
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=AAB9B3905E93FDE63A41BF51929A3CADCCA064AB
        Validity
            Not Before: Feb  2 19:55:03 2023 GMT
            Not After : Feb  1 20:00:03 2024 GMT
        Subject: CN=3082010A0282010100BEBA37F2FB739C6644D5D4F61026DAF7B9B1DAB30799FCF83D866291BA52818901B94C15168E79403B26B29FCD8E7E408A9DE99DFE8D6AD5415C8DDC67D704EC02DC15F021F32317BCDF6BABFA350D45CD2C68516DCE610CDBE545FB8C68AE6ACFEC13389CE4496E04B0F77C107466A0177FF04E6BF30A6CFE3DDC50C451126C5727355B8B7D7BC94CECF58046C6F4169C40E569AE7903ED19D9794C1B65CE0DC26A2CE2C61C75DCAE72E79382A02CAA28708F4952F9EE1DE6622C0FF9C155356FCC3DC6A2B3B0131E2268B919425E9F3A2515C83B73BD62942E8FE6AF4FE351B528273D2C164817D7AA52A5338ED637FE27205A7DC2F2FB841E9FD81A05FE210203010001
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:be:ba:37:f2:fb:73:9c:66:44:d5:d4:f6:10:26:
                    da:f7:b9:b1:da:b3:07:99:fc:f8:3d:86:62:91:ba:
                    52:81:89:01:b9:4c:15:16:8e:79:40:3b:26:b2:9f:
                    cd:8e:7e:40:8a:9d:e9:9d:fe:8d:6a:d5:41:5c:8d:
                    dc:67:d7:04:ec:02:dc:15:f0:21:f3:23:17:bc:df:
                    6b:ab:fa:35:0d:45:cd:2c:68:51:6d:ce:61:0c:db:
                    e5:45:fb:8c:68:ae:6a:cf:ec:13:38:9c:e4:49:6e:
                    04:b0:f7:7c:10:74:66:a0:17:7f:f0:4e:6b:f3:0a:
                    6c:fe:3d:dc:50:c4:51:12:6c:57:27:35:5b:8b:7d:
                    7b:c9:4c:ec:f5:80:46:c6:f4:16:9c:40:e5:69:ae:
                    79:03:ed:19:d9:79:4c:1b:65:ce:0d:c2:6a:2c:e2:
                    c6:1c:75:dc:ae:72:e7:93:82:a0:2c:aa:28:70:8f:
                    49:52:f9:ee:1d:e6:62:2c:0f:f9:c1:55:35:6f:cc:
                    3d:c6:a2:b3:b0:13:1e:22:68:b9:19:42:5e:9f:3a:
                    25:15:c8:3b:73:bd:62:94:2e:8f:e6:af:4f:e3:51:
                    b5:28:27:3d:2c:16:48:17:d7:aa:52:a5:33:8e:d6:
                    37:fe:27:20:5a:7d:c2:f2:fb:84:1e:9f:d8:1a:05:
                    fe:21
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                BD:D4:DC:13:A9:62:3B:57:51:4D:50:C0:F9:AF:40:C2:C1:87:D7:79
            X509v3 Authority Key Identifier:
                keyid:AA:B9:B3:90:5E:93:FD:E6:3A:41:BF:51:92:9A:3C:AD:CC:A0:64:AB

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki-repo.registro.br/repo/Fyy9t7bAaY1SRtMjjkXwUMnEcxYueq65dZ9LaV1ND2yA/0/AAB9B3905E93FDE63A41BF51929A3CADCCA064AB.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki-repo.registro.br/repo/nicbr_repo/0/AAB9B3905E93FDE63A41BF51929A3CADCCA064AB.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki-repo.registro.br/repo/Fyy9t7bAaY1SRtMjjkXwUMnEcxYueq65dZ9LaV1ND2yA/0/3138372e31392e382e302f32312d3231203d3e203238313234.roa

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv4:
                  187.19.8.0/21

    Signature Algorithm: sha256WithRSAEncryption
         6b:37:2b:b8:9b:1c:31:68:bc:0d:d0:a4:f6:33:2b:3e:e2:05:
         e3:8d:04:68:36:6d:25:2a:da:fb:34:c4:0b:24:7e:8a:c8:23:
         74:76:20:39:50:3b:f7:57:b7:6f:0f:51:47:61:bc:38:ac:a4:
         a9:55:22:3a:3c:8c:05:08:2f:5f:f9:4a:7a:ae:a3:0c:66:71:
         c3:62:5f:22:ee:47:88:07:ab:40:bb:c2:2b:d2:6a:e0:27:d5:
         fc:c5:1c:35:58:22:be:ce:25:e3:fc:e0:1e:25:6e:be:49:20:
         c9:7c:f0:f2:84:07:06:8e:f2:83:f7:65:5e:dd:44:58:f0:7f:
         9d:0a:52:8d:34:d9:9f:30:d9:ec:6c:65:19:89:2b:a5:47:d1:
         2b:22:89:ee:76:e5:9a:81:35:20:04:43:61:ee:b9:23:b8:bb:
         3e:03:75:28:44:af:15:ef:ce:07:ce:79:82:1c:4f:3b:ce:09:
         bf:94:59:f3:84:00:4b:af:90:e8:9a:e4:60:7a:7a:0c:27:5d:
         70:c8:93:5f:b5:bb:db:49:05:b2:d5:54:b3:63:0b:a4:7f:80:
         a5:16:85:8a:90:04:e3:7c:59:d9:e4:ce:8e:2a:60:c3:ec:24:
         25:98:f6:2c:a2:54:a6:b8:27:1c:0f:ec:7e:88:8f:b2:a0:f7:
         8b:f3:a7:1b
-----BEGIN CERTIFICATE-----
MIIHPTCCBiWgAwIBAgIURjYAtamxs/2EJdQ1FpOa8zOnDuUwDQYJKoZIhvcNAQEL
BQAwMzExMC8GA1UEAxMoQUFCOUIzOTA1RTkzRkRFNjNBNDFCRjUxOTI5QTNDQURD
Q0EwNjRBQjAeFw0yMzAyMDIxOTU1MDNaFw0yNDAyMDEyMDAwMDNaMIICLTGCAikw
ggIlBgNVBAMTggIcMzA4MjAxMEEwMjgyMDEwMTAwQkVCQTM3RjJGQjczOUM2NjQ0
RDVENEY2MTAyNkRBRjdCOUIxREFCMzA3OTlGQ0Y4M0Q4NjYyOTFCQTUyODE4OTAx
Qjk0QzE1MTY4RTc5NDAzQjI2QjI5RkNEOEU3RTQwOEE5REU5OURGRThENkFENTQx
NUM4RERDNjdENzA0RUMwMkRDMTVGMDIxRjMyMzE3QkNERjZCQUJGQTM1MEQ0NUNE
MkM2ODUxNkRDRTYxMENEQkU1NDVGQjhDNjhBRTZBQ0ZFQzEzMzg5Q0U0NDk2RTA0
QjBGNzdDMTA3NDY2QTAxNzdGRjA0RTZCRjMwQTZDRkUzRERDNTBDNDUxMTI2QzU3
MjczNTVCOEI3RDdCQzk0Q0VDRjU4MDQ2QzZGNDE2OUM0MEU1NjlBRTc5MDNFRDE5
RDk3OTRDMUI2NUNFMERDMjZBMkNFMkM2MUM3NURDQUU3MkU3OTM4MkEwMkNBQTI4
NzA4RjQ5NTJGOUVFMURFNjYyMkMwRkY5QzE1NTM1NkZDQzNEQzZBMkIzQjAxMzFF
MjI2OEI5MTk0MjVFOUYzQTI1MTVDODNCNzNCRDYyOTQyRThGRTZBRjRGRTM1MUI1
MjgyNzNEMkMxNjQ4MTdEN0FBNTJBNTMzOEVENjM3RkUyNzIwNUE3REMyRjJGQjg0
MUU5RkQ4MUEwNUZFMjEwMjAzMDEwMDAxMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEAvro38vtznGZE1dT2ECba97mx2rMHmfz4PYZikbpSgYkBuUwVFo55
QDsmsp/Njn5Aip3pnf6NatVBXI3cZ9cE7ALcFfAh8yMXvN9rq/o1DUXNLGhRbc5h
DNvlRfuMaK5qz+wTOJzkSW4EsPd8EHRmoBd/8E5r8wps/j3cUMRREmxXJzVbi317
yUzs9YBGxvQWnEDlaa55A+0Z2XlMG2XODcJqLOLGHHXcrnLnk4KgLKoocI9JUvnu
HeZiLA/5wVU1b8w9xqKzsBMeImi5GUJenzolFcg7c71ilC6P5q9P41G1KCc9LBZI
F9eqUqUzjtY3/icgWn3C8vuEHp/YGgX+IQIDAQABo4ICSzCCAkcwHQYDVR0OBBYE
FL3U3BOpYjtXUU1QwPmvQMLBh9d5MB8GA1UdIwQYMBaAFKq5s5Bek/3mOkG/UZKa
PK3MoGSrMA4GA1UdDwEB/wQEAwIHgDCBlAYDVR0fBIGMMIGJMIGGoIGDoIGAhn5y
c3luYzovL3Jwa2ktcmVwby5yZWdpc3Ryby5ici9yZXBvL0Z5eTl0N2JBYVkxU1J0
TWpqa1h3VU1uRWN4WXVlcTY1ZFo5TGFWMU5EMnlBLzAvQUFCOUIzOTA1RTkzRkRF
NjNBNDFCRjUxOTI5QTNDQURDQ0EwNjRBQi5jcmwweAYIKwYBBQUHAQEEbDBqMGgG
CCsGAQUFBzAChlxyc3luYzovL3Jwa2ktcmVwby5yZWdpc3Ryby5ici9yZXBvL25p
Y2JyX3JlcG8vMC9BQUI5QjM5MDVFOTNGREU2M0E0MUJGNTE5MjlBM0NBRENDQTA2
NEFCLmNlcjCBqAYIKwYBBQUHAQsEgZswgZgwgZUGCCsGAQUFBzALhoGIcnN5bmM6
Ly9ycGtpLXJlcG8ucmVnaXN0cm8uYnIvcmVwby9GeXk5dDdiQWFZMVNSdE1qamtY
d1VNbkVjeFl1ZXE2NWRaOUxhVjFORDJ5QS8wLzMxMzgzNzJlMzEzOTJlMzgyZTMw
MmYzMjMxMmQzMjMxMjAzZDNlMjAzMjM4MzEzMjM0LnJvYTAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMB8GCCsGAQUFBwEHAQH/BBAwDjAMBAIAATAGAwQDuxMIMA0G
CSqGSIb3DQEBCwUAA4IBAQBrNyu4mxwxaLwN0KT2Mys+4gXjjQRoNm0lKtr7NMQL
JH6KyCN0diA5UDv3V7dvD1FHYbw4rKSpVSI6PIwFCC9f+Up6rqMMZnHDYl8i7keI
B6tAu8Ir0mrgJ9X8xRw1WCK+ziXj/OAeJW6+SSDJfPDyhAcGjvKD92Ve3URY8H+d
ClKNNNmfMNnsbGUZiSulR9ErIonuduWagTUgBENh7rkjuLs+A3UoRK8V784HznmC
HE87zgm/lFnzhABLr5DomuRgenoMJ11wyJNftbvbSQWy1VSzYwukf4ClFoWKkATj
fFnZ5M6OKmDD7CQlmPYsolSmuCccD+x+iI+yoPeL86cb
-----END CERTIFICATE-----