Route Origin Authorization

$ rpki-client -vvf rpki.apnic.net/member_repository/A912BE25/D90526E4EE1111EC95299982C4F9AE02/C281C078052A11ED8C577711C4F9AE02.roa
File:                     C281C078052A11ED8C577711C4F9AE02.roa (raw, json)
Hash identifier:          3cFvd2zdgmKAWbHvQCpeUGkgVMq0k7ibJXEbB4w9/WQ=
Subject key identifier:   53:25:4C:A2:A6:BF:50:95:22:18:AF:C9:E4:0B:AD:E1:96:A9:B6:C4
Certificate issuer:       /CN=A912BE25/serialNumber=A760ADE0C9D05EE679EC304122BC3350C8D2A439
Certificate serial:       4A
Authority key identifier: A7:60:AD:E0:C9:D0:5E:E6:79:EC:30:41:22:BC:33:50:C8:D2:A4:39
Authority info access:    rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/p2Ct4MnQXuZ57DBBIrwzUMjSpDk.cer
Subject info access:      rsync://rpki.apnic.net/member_repository/A912BE25/D90526E4EE1111EC95299982C4F9AE02/C281C078052A11ED8C577711C4F9AE02.roa
Signing time:             Sat 16 Jul 2022 17:14:33 +0000
ROA not before:           Sat 16 Jul 2022 17:14:33 +0000
ROA not after:            Thu 01 Dec 2022 00:00:00 +0000
asID:                     23887
IP address blocks:        119.63.0.0/20 maxlen: 20
                          119.63.0.0/22 maxlen: 22
                          119.63.0.0/23 maxlen: 23
                          119.63.2.0/24 maxlen: 24
                          202.71.176.0/20 maxlen: 20
                          202.71.179.0/24 maxlen: 24
                          202.71.182.0/23 maxlen: 23
                          202.71.186.0/24 maxlen: 24
                          202.71.190.0/24 maxlen: 24
                          202.71.191.0/24 maxlen: 24
                          2406:2a00::/32 maxlen: 32

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 74 (0x4a)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=A912BE25/serialNumber=A760ADE0C9D05EE679EC304122BC3350C8D2A439
        Validity
            Not Before: Jul 16 17:14:33 2022 GMT
            Not After : Dec  1 00:00:00 2022 GMT
        Subject: CN=62d2f1f9-5486
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:a2:51:20:37:f4:44:5e:f8:d6:43:9a:47:7c:d3:
                    3a:5c:9e:e3:8f:27:de:c6:99:42:20:3d:fb:d7:4d:
                    0f:41:dd:e9:23:a9:b9:b0:05:5b:ae:98:3d:1b:a3:
                    e3:91:22:bb:66:83:c0:89:c4:60:6e:1e:c4:d9:63:
                    11:47:9d:33:a7:16:81:7d:3c:04:8c:32:c8:41:e2:
                    43:1c:90:ae:4f:bd:62:58:df:37:5d:0c:fa:4e:8e:
                    a1:da:8c:d9:72:b7:76:08:7c:91:dc:0e:c2:66:dc:
                    52:49:8c:eb:2b:b9:d8:17:64:bc:da:36:95:d9:8b:
                    19:0d:53:5b:51:37:31:ca:51:ef:03:f8:af:ef:43:
                    52:3b:89:3d:5c:54:e4:d0:62:86:dd:7d:a7:25:a4:
                    d4:05:30:99:9a:84:8a:89:6d:6a:10:c1:0a:c9:e1:
                    8f:12:ed:55:76:49:9a:2a:8e:ef:c5:1a:b2:c0:d6:
                    e6:d8:af:75:82:a3:67:6b:6d:90:80:9e:26:bd:53:
                    b7:de:10:b3:a6:e6:f2:ed:27:b3:21:b4:2d:75:3c:
                    62:ad:4d:9b:4a:60:6c:d5:ae:b5:40:3d:b3:26:dc:
                    1f:2f:c5:b4:13:74:03:b0:40:a6:d9:e4:c2:4a:a2:
                    10:9a:ad:80:40:ad:fd:ef:cd:fd:34:3a:03:a6:ad:
                    57:23
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                53:25:4C:A2:A6:BF:50:95:22:18:AF:C9:E4:0B:AD:E1:96:A9:B6:C4
            X509v3 Authority Key Identifier:
                keyid:A7:60:AD:E0:C9:D0:5E:E6:79:EC:30:41:22:BC:33:50:C8:D2:A4:39

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.apnic.net/member_repository/A912BE25/D90526E4EE1111EC95299982C4F9AE02/p2Ct4MnQXuZ57DBBIrwzUMjSpDk.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/p2Ct4MnQXuZ57DBBIrwzUMjSpDk.cer

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber
                  CPS: https://www.apnic.net/RPKI/CPS.pdf

            Subject Information Access:
                Signed Object - URI:rsync://rpki.apnic.net/member_repository/A912BE25/D90526E4EE1111EC95299982C4F9AE02/C281C078052A11ED8C577711C4F9AE02.roa
                RPKI Notify - URI:https://rrdp.apnic.net/notification.xml

            sbgp-ipAddrBlock: critical
                IPv4:
                  119.63.0.0/20
                  202.71.176.0/20
                IPv6:
                  2406:2a00::/32

    Signature Algorithm: sha256WithRSAEncryption
         79:b5:2b:34:69:76:ea:73:fa:f3:96:a3:bd:ef:33:86:34:f7:
         0f:ad:a6:e1:c6:77:50:2d:15:7b:df:1b:97:e7:16:08:cc:e6:
         7e:d2:75:56:08:a6:ca:d0:05:f6:2f:02:b5:ce:1b:41:6f:0c:
         0f:7b:a0:d3:77:4a:c2:2f:d2:09:0e:1e:9b:b7:e4:9d:26:fa:
         b8:fc:93:33:6b:b0:d2:43:1c:f6:46:f5:93:0a:3a:85:85:df:
         0c:45:1b:cd:18:13:53:87:4d:9d:73:bc:8d:74:23:67:6d:b9:
         0f:1b:d8:eb:26:b2:a1:07:b7:c7:55:0d:57:24:c2:99:3b:b6:
         a6:ba:df:91:d6:a7:56:cf:d9:df:8b:d4:5e:48:48:f3:9d:0b:
         cd:de:d9:78:17:5a:42:02:cb:82:f7:14:fa:3a:e2:89:2e:0c:
         32:f3:c7:b6:a3:b7:71:1b:54:eb:24:c2:54:28:68:db:38:a4:
         7a:da:75:29:41:c5:6d:39:37:ea:2e:57:6e:38:04:2a:fa:a0:
         d6:2a:37:c3:36:3f:61:34:ab:8f:f5:90:a3:d0:09:85:f3:1f:
         70:fd:0b:96:c5:bc:aa:bd:d8:35:1b:65:09:60:6f:46:e8:3d:
         1b:c1:02:bc:a5:0c:2c:17:9e:0c:74:76:15:b5:47:90:c0:01:
         16:32:2b:c0
-----BEGIN CERTIFICATE-----
MIIFhTCCBG2gAwIBAgIBSjANBgkqhkiG9w0BAQsFADBGMREwDwYDVQQDEwhBOTEy
QkUyNTExMC8GA1UEBRMoQTc2MEFERTBDOUQwNUVFNjc5RUMzMDQxMjJCQzMzNTBD
OEQyQTQzOTAeFw0yMjA3MTYxNzE0MzNaFw0yMjEyMDEwMDAwMDBaMBgxFjAUBgNV
BAMTDTYyZDJmMWY5LTU0ODYwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQCiUSA39ERe+NZDmkd80zpcnuOPJ97GmUIgPfvXTQ9B3ekjqbmwBVuumD0bo+OR
Irtmg8CJxGBuHsTZYxFHnTOnFoF9PASMMshB4kMckK5PvWJY3zddDPpOjqHajNly
t3YIfJHcDsJm3FJJjOsrudgXZLzaNpXZixkNU1tRNzHKUe8D+K/vQ1I7iT1cVOTQ
YobdfaclpNQFMJmahIqJbWoQwQrJ4Y8S7VV2SZoqju/FGrLA1ubYr3WCo2drbZCA
nia9U7feELOm5vLtJ7MhtC11PGKtTZtKYGzVrrVAPbMm3B8vxbQTdAOwQKbZ5MJK
ohCarYBArf3vzf00OgOmrVcjAgMBAAGjggKqMIICpjAdBgNVHQ4EFgQUUyVMoqa/
UJUiGK/J5Aut4ZaptsQwHwYDVR0jBBgwFoAUp2Ct4MnQXuZ57DBBIrwzUMjSpDkw
DgYDVR0PAQH/BAQDAgeAMIGDBgNVHR8EfDB6MHigdqB0hnJyc3luYzovL3Jwa2ku
YXBuaWMubmV0L21lbWJlcl9yZXBvc2l0b3J5L0E5MTJCRTI1L0Q5MDUyNkU0RUUx
MTExRUM5NTI5OTk4MkM0RjlBRTAyL3AyQ3Q0TW5RWHVaNTdEQkJJcnd6VU1qU3BE
ay5jcmwwfgYIKwYBBQUHAQEEcjBwMG4GCCsGAQUFBzAChmJyc3luYzovL3Jwa2ku
YXBuaWMubmV0L3JlcG9zaXRvcnkvQjUyN0VGNTgxRDY2MTFFMkJCNDY4RjdDNzJG
RDFGRjIvcDJDdDRNblFYdVo1N0RCQklyd3pVTWpTcERrLmNlcjBKBgNVHSABAf8E
QDA+MDwGCCsGAQUFBw4CMDAwLgYIKwYBBQUHAgEWImh0dHBzOi8vd3d3LmFwbmlj
Lm5ldC9SUEtJL0NQUy5wZGYwgcsGCCsGAQUFBwELBIG+MIG7MIGDBggrBgEFBQcw
C4Z3cnN5bmM6Ly9ycGtpLmFwbmljLm5ldC9tZW1iZXJfcmVwb3NpdG9yeS9BOTEy
QkUyNS9EOTA1MjZFNEVFMTExMUVDOTUyOTk5ODJDNEY5QUUwMi9DMjgxQzA3ODA1
MkExMUVEOEM1Nzc3MTFDNEY5QUUwMi5yb2EwMwYIKwYBBQUHMA2GJ2h0dHBzOi8v
cnJkcC5hcG5pYy5uZXQvbm90aWZpY2F0aW9uLnhtbDA0BggrBgEFBQcBBwEB/wQl
MCMwEgQCAAEwDAMEBHc/AAMEBMpHsDANBAIAAjAHAwUAJAYqADANBgkqhkiG9w0B
AQsFAAOCAQEAebUrNGl26nP685ajve8zhjT3D62m4cZ3UC0Ve98bl+cWCMzmftJ1
VgimytAF9i8Ctc4bQW8MD3ug03dKwi/SCQ4em7fknSb6uPyTM2uw0kMc9kb1kwo6
hYXfDEUbzRgTU4dNnXO8jXQjZ225DxvY6yayoQe3x1UNVyTCmTu2prrfkdanVs/Z
34vUXkhI850Lzd7ZeBdaQgLLgvcU+jriiS4MMvPHtqO3cRtU6yTCVCho2ziketp1
KUHFbTk36i5XbjgEKvqg1io3wzY/YTSrj/WQo9AJhfMfcP0LlsW8qr3YNRtlCWBv
Rug9G8ECvKUMLBeeDHR2FbVHkMABFjIrwA==
-----END CERTIFICATE-----