Route Origin Authorization

$ rpki-client -vvf rpki.apnic.net/member_repository/A914233F/85C20BDA463C11EE9B789139C4F9AE02/220BD958465611EEA86C8D1AC4F9AE02.roa
File:                     220BD958465611EEA86C8D1AC4F9AE02.roa (raw, json)
Hash identifier:          ESWglgaW/9tO5TyTnzyCutv8Y+8YPS8y+Spo7psswA4=
Subject key identifier:   2A:91:36:FD:5F:AE:B0:DB:EC:EF:47:D0:56:C6:4A:0A:51:C2:6C:4A
Certificate issuer:       /CN=A914233F/serialNumber=3C750FD6CB8C7701681E536BDD6B715F192B8AF9
Certificate serial:       06
Authority key identifier: 3C:75:0F:D6:CB:8C:77:01:68:1E:53:6B:DD:6B:71:5F:19:2B:8A:F9
Authority info access:    rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/PHUP1suMdwFoHlNr3WtxXxkrivk.cer
Subject info access:      rsync://rpki.apnic.net/member_repository/A914233F/85C20BDA463C11EE9B789139C4F9AE02/220BD958465611EEA86C8D1AC4F9AE02.roa
Signing time:             Tue 29 Aug 2023 10:23:45 +0000
ROA not before:           Tue 29 Aug 2023 10:23:45 +0000
ROA not after:            Sun 01 Dec 2024 00:00:00 +0000
asID:                     61317
IP address blocks:        103.41.72.0/23 maxlen: 24
                          2001:df2:dfc0::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 6 (0x6)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=A914233F/serialNumber=3C750FD6CB8C7701681E536BDD6B715F192B8AF9
        Validity
            Not Before: Aug 29 10:23:45 2023 GMT
            Not After : Dec  1 00:00:00 2024 GMT
        Subject: CN=64edc730-2b3a
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:db:20:51:92:af:ce:d1:fc:bb:bd:f2:ce:e0:ca:
                    af:a6:2a:10:93:9e:34:f6:b3:73:49:1a:79:46:28:
                    e7:c8:d8:54:cd:46:77:ce:52:1d:77:39:ef:61:dd:
                    eb:c0:89:b3:d6:0c:ea:b3:1b:68:12:57:75:e9:c4:
                    61:2e:fc:a3:ee:fe:9e:10:bc:6d:f4:4c:9c:69:2a:
                    a3:fe:59:df:62:2d:15:f2:d8:de:31:c1:9f:b7:fe:
                    53:f5:3b:8a:18:68:18:aa:3f:bf:0e:46:a8:a0:c6:
                    d6:e8:82:19:f4:7f:18:2b:3c:5c:e4:5c:73:f1:95:
                    cb:d9:ee:d9:a5:95:ea:1d:f6:b4:92:cc:09:da:06:
                    18:40:15:a3:f2:a1:05:bf:b2:ba:39:5a:4f:52:f2:
                    93:09:6f:08:30:7b:9c:aa:cb:ef:88:45:c6:58:21:
                    f4:f0:d3:82:74:f2:d6:e0:7e:90:6d:4c:73:9b:ec:
                    a7:ab:56:e0:25:77:91:bd:0b:7f:e1:af:df:d9:0f:
                    0c:4c:95:c8:61:76:99:1e:a0:76:fb:04:a5:dd:8f:
                    16:f1:9b:29:41:87:56:6e:ac:fb:03:10:ac:7e:ee:
                    49:a7:8b:93:d6:47:0f:da:1c:e2:b6:e0:5f:7b:bc:
                    80:ec:c0:c4:d5:45:8c:60:cf:5a:48:6b:3e:cc:ea:
                    2a:dd
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                2A:91:36:FD:5F:AE:B0:DB:EC:EF:47:D0:56:C6:4A:0A:51:C2:6C:4A
            X509v3 Authority Key Identifier:
                keyid:3C:75:0F:D6:CB:8C:77:01:68:1E:53:6B:DD:6B:71:5F:19:2B:8A:F9

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.apnic.net/member_repository/A914233F/85C20BDA463C11EE9B789139C4F9AE02/PHUP1suMdwFoHlNr3WtxXxkrivk.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/PHUP1suMdwFoHlNr3WtxXxkrivk.cer

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber
                  CPS: https://www.apnic.net/RPKI/CPS.pdf

            Subject Information Access:
                Signed Object - URI:rsync://rpki.apnic.net/member_repository/A914233F/85C20BDA463C11EE9B789139C4F9AE02/220BD958465611EEA86C8D1AC4F9AE02.roa
                RPKI Notify - URI:https://rrdp.apnic.net/notification.xml

            sbgp-ipAddrBlock: critical
                IPv4:
                  103.41.72.0/23
                IPv6:
                  2001:df2:dfc0::/48

    Signature Algorithm: sha256WithRSAEncryption
         94:4a:07:b4:26:13:8d:31:33:33:14:17:be:0c:36:15:3f:0a:
         64:17:bf:1e:5a:4f:a8:4a:16:67:08:e4:86:c0:e2:c8:ef:2e:
         6d:d8:fb:7d:5d:20:1f:fb:ee:4d:08:3d:14:21:d9:42:29:88:
         52:eb:a6:b7:41:78:89:76:51:e3:ef:b6:4a:c2:40:cf:f0:bd:
         e2:2d:ea:d3:a3:9f:81:31:9c:fd:e8:5d:7a:93:be:ac:bf:4e:
         9c:f7:bf:0b:f6:be:67:79:f4:4f:21:64:dd:a1:f5:a7:f6:fd:
         fe:90:9b:63:ac:93:9f:6b:58:da:fe:2f:e2:20:f1:c8:03:38:
         7a:72:e0:29:bb:b0:39:da:36:e5:86:3a:05:94:03:63:d4:db:
         5d:dd:af:19:72:bc:a1:54:d7:af:85:d1:be:b6:df:eb:b0:9d:
         8b:aa:3d:1c:ac:d4:54:37:85:ef:4b:92:35:62:ac:7b:76:2e:
         f7:94:83:4d:e3:5b:f4:0e:6d:ac:45:f3:62:b1:a2:86:5a:5c:
         d0:05:05:87:ae:c5:8c:52:3b:3b:25:00:fb:54:5e:a2:48:40:
         74:9b:eb:b5:6f:a9:23:da:b3:b6:be:f8:ff:89:e4:1f:90:f0:
         5a:4d:6f:26:4f:9f:e0:e7:c5:d0:d4:9f:12:1a:eb:98:2f:6d:
         44:99:4c:a0
-----BEGIN CERTIFICATE-----
MIIFgTCCBGmgAwIBAgIBBjANBgkqhkiG9w0BAQsFADBGMREwDwYDVQQDEwhBOTE0
MjMzRjExMC8GA1UEBRMoM0M3NTBGRDZDQjhDNzcwMTY4MUU1MzZCREQ2QjcxNUYx
OTJCOEFGOTAeFw0yMzA4MjkxMDIzNDVaFw0yNDEyMDEwMDAwMDBaMBgxFjAUBgNV
BAMTDTY0ZWRjNzMwLTJiM2EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQDbIFGSr87R/Lu98s7gyq+mKhCTnjT2s3NJGnlGKOfI2FTNRnfOUh13Oe9h3evA
ibPWDOqzG2gSV3XpxGEu/KPu/p4QvG30TJxpKqP+Wd9iLRXy2N4xwZ+3/lP1O4oY
aBiqP78ORqigxtboghn0fxgrPFzkXHPxlcvZ7tmlleod9rSSzAnaBhhAFaPyoQW/
sro5Wk9S8pMJbwgwe5yqy++IRcZYIfTw04J08tbgfpBtTHOb7KerVuAld5G9C3/h
r9/ZDwxMlchhdpkeoHb7BKXdjxbxmylBh1ZurPsDEKx+7kmni5PWRw/aHOK24F97
vIDswMTVRYxgz1pIaz7M6irdAgMBAAGjggKmMIICojAdBgNVHQ4EFgQUKpE2/V+u
sNvs70fQVsZKClHCbEowHwYDVR0jBBgwFoAUPHUP1suMdwFoHlNr3WtxXxkrivkw
DgYDVR0PAQH/BAQDAgeAMIGDBgNVHR8EfDB6MHigdqB0hnJyc3luYzovL3Jwa2ku
YXBuaWMubmV0L21lbWJlcl9yZXBvc2l0b3J5L0E5MTQyMzNGLzg1QzIwQkRBNDYz
QzExRUU5Qjc4OTEzOUM0RjlBRTAyL1BIVVAxc3VNZHdGb0hsTnIzV3R4WHhrcml2
ay5jcmwwfgYIKwYBBQUHAQEEcjBwMG4GCCsGAQUFBzAChmJyc3luYzovL3Jwa2ku
YXBuaWMubmV0L3JlcG9zaXRvcnkvQjUyN0VGNTgxRDY2MTFFMkJCNDY4RjdDNzJG
RDFGRjIvUEhVUDFzdU1kd0ZvSGxOcjNXdHhYeGtyaXZrLmNlcjBKBgNVHSABAf8E
QDA+MDwGCCsGAQUFBw4CMDAwLgYIKwYBBQUHAgEWImh0dHBzOi8vd3d3LmFwbmlj
Lm5ldC9SUEtJL0NQUy5wZGYwgcsGCCsGAQUFBwELBIG+MIG7MIGDBggrBgEFBQcw
C4Z3cnN5bmM6Ly9ycGtpLmFwbmljLm5ldC9tZW1iZXJfcmVwb3NpdG9yeS9BOTE0
MjMzRi84NUMyMEJEQTQ2M0MxMUVFOUI3ODkxMzlDNEY5QUUwMi8yMjBCRDk1ODQ2
NTYxMUVFQTg2QzhEMUFDNEY5QUUwMi5yb2EwMwYIKwYBBQUHMA2GJ2h0dHBzOi8v
cnJkcC5hcG5pYy5uZXQvbm90aWZpY2F0aW9uLnhtbDAwBggrBgEFBQcBBwEB/wQh
MB8wDAQCAAEwBgMEAWcpSDAPBAIAAjAJAwcAIAEN8t/AMA0GCSqGSIb3DQEBCwUA
A4IBAQCUSge0JhONMTMzFBe+DDYVPwpkF78eWk+oShZnCOSGwOLI7y5t2Pt9XSAf
++5NCD0UIdlCKYhS66a3QXiJdlHj77ZKwkDP8L3iLerTo5+BMZz96F16k76sv06c
978L9r5nefRPIWTdofWn9v3+kJtjrJOfa1ja/i/iIPHIAzh6cuApu7A52jblhjoF
lANj1Ntd3a8ZcryhVNevhdG+tt/rsJ2Lqj0crNRUN4XvS5I1Yqx7di73lINN41v0
Dm2sRfNisaKGWlzQBQWHrsWMUjs7JQD7VF6iSEB0m+u1b6kj2rO2vvj/ieQfkPBa
TW8mT5/g58XQ1J8SGuuYL21EmUyg
-----END CERTIFICATE-----