Route Origin Authorization

$ rpki-client -vvf rpki.apnic.net/member_repository/A9146944/43BD1C6E8E9511EAA9D73A2EC4F9AE02/C687BF42D50011EC916B8369C4F9AE02.roa
File:                     C687BF42D50011EC916B8369C4F9AE02.roa (raw, json)
Hash identifier:          gRlsReZ+GEle3Rsdwj5N7dTes7QmCRS7ujN6eMAifN4=
Subject key identifier:   B3:5F:2B:61:94:EE:E5:E4:70:6D:37:94:8A:A2:40:96:04:47:D3:F2
Certificate issuer:       /CN=A9146944/serialNumber=ED1F958CB604B576E82214B4CF3CC0FE620EF9F4
Certificate serial:       06ED
Authority key identifier: ED:1F:95:8C:B6:04:B5:76:E8:22:14:B4:CF:3C:C0:FE:62:0E:F9:F4
Authority info access:    rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/7R-VjLYEtXboIhS0zzzA_mIO-fQ.cer
Subject info access:      rsync://rpki.apnic.net/member_repository/A9146944/43BD1C6E8E9511EAA9D73A2EC4F9AE02/C687BF42D50011EC916B8369C4F9AE02.roa
Signing time:             Sat 25 Jun 2022 22:02:41 +0000
ROA not before:           Sat 25 Jun 2022 22:02:41 +0000
ROA not after:            Thu 31 Aug 2023 00:00:00 +0000
asID:                     134180
IP address blocks:        45.127.248.0/24 maxlen: 24
                          45.127.249.0/24 maxlen: 24
                          45.127.250.0/24 maxlen: 24
                          45.127.251.0/24 maxlen: 24
                          45.250.228.0/24 maxlen: 24
                          45.250.229.0/24 maxlen: 24
                          45.250.230.0/24 maxlen: 24
                          45.250.231.0/24 maxlen: 24
                          103.199.232.0/24 maxlen: 24
                          103.199.233.0/24 maxlen: 24
                          103.199.234.0/23 maxlen: 24
                          103.202.220.0/22 maxlen: 22
                          103.202.220.0/24 maxlen: 24
                          103.202.221.0/24 maxlen: 24
                          103.202.222.0/23 maxlen: 23
                          103.202.222.0/24 maxlen: 24
                          103.202.223.0/24 maxlen: 24
                          103.209.196.0/24 maxlen: 24
                          103.209.197.0/24 maxlen: 24
                          103.209.198.0/24 maxlen: 24
                          103.209.199.0/24 maxlen: 24
                          202.133.88.0/24 maxlen: 24
                          202.133.89.0/24 maxlen: 24
                          202.133.91.0/24 maxlen: 24
                          2403:6940::/32 maxlen: 32

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1773 (0x6ed)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=A9146944/serialNumber=ED1F958CB604B576E82214B4CF3CC0FE620EF9F4
        Validity
            Not Before: Jun 25 22:02:41 2022 GMT
            Not After : Aug 31 00:00:00 2023 GMT
        Subject: CN=62b78601-a1ca
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b7:de:67:59:66:e1:cd:1c:a5:53:19:11:52:74:
                    af:95:e4:30:73:31:83:a2:22:c5:54:92:7a:a2:7b:
                    ad:45:f1:9f:05:12:1d:30:68:40:a2:56:51:7a:a4:
                    d9:8c:1a:8f:4d:53:bd:3a:ef:6e:5c:da:ec:f5:33:
                    fd:b2:3e:cb:83:b4:ab:b7:a0:12:d4:b7:2a:f7:93:
                    7c:33:88:ae:3a:a1:22:d9:f8:fd:9e:c6:b1:40:17:
                    f1:49:2d:80:b4:f0:2a:9d:37:38:cf:0f:82:91:a0:
                    75:1e:b9:e7:a1:63:9e:54:80:30:7b:40:1c:10:ed:
                    ca:33:d7:98:67:26:74:3d:db:4f:10:ff:bc:e6:85:
                    ab:5f:11:30:c0:4a:3e:59:71:ae:6b:19:a5:0a:0e:
                    27:e4:54:5c:60:cc:c2:3b:5c:13:ab:60:8f:24:ae:
                    8d:79:ed:a5:bb:f5:19:b8:62:c3:60:18:2f:04:f6:
                    0f:8e:19:8e:54:50:95:8b:5a:a0:d3:f3:1b:b5:eb:
                    78:a6:1b:57:ff:50:bf:56:58:a7:27:98:7f:70:18:
                    2c:34:4a:77:59:ea:11:9f:78:b4:80:fb:01:5d:fb:
                    69:11:dd:db:c6:5a:c8:5f:45:ca:4a:9c:c6:62:10:
                    9d:a4:81:51:5f:1c:1e:7a:02:ec:1d:89:11:3e:b6:
                    33:53
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                B3:5F:2B:61:94:EE:E5:E4:70:6D:37:94:8A:A2:40:96:04:47:D3:F2
            X509v3 Authority Key Identifier:
                keyid:ED:1F:95:8C:B6:04:B5:76:E8:22:14:B4:CF:3C:C0:FE:62:0E:F9:F4

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.apnic.net/member_repository/A9146944/43BD1C6E8E9511EAA9D73A2EC4F9AE02/7R-VjLYEtXboIhS0zzzA_mIO-fQ.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/7R-VjLYEtXboIhS0zzzA_mIO-fQ.cer

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber
                  CPS: https://www.apnic.net/RPKI/CPS.pdf

            Subject Information Access:
                Signed Object - URI:rsync://rpki.apnic.net/member_repository/A9146944/43BD1C6E8E9511EAA9D73A2EC4F9AE02/C687BF42D50011EC916B8369C4F9AE02.roa
                RPKI Notify - URI:https://rrdp.apnic.net/notification.xml

            sbgp-ipAddrBlock: critical
                IPv4:
                  45.127.248.0/22
                  45.250.228.0/22
                  103.199.232.0/22
                  103.202.220.0/22
                  103.209.196.0/22
                  202.133.88.0/23
                  202.133.91.0/24
                IPv6:
                  2403:6940::/32

    Signature Algorithm: sha256WithRSAEncryption
         8c:ea:f0:bf:1c:eb:19:eb:7b:35:ce:cb:ad:8f:18:96:7d:c1:
         59:4d:c2:9d:0b:9b:93:63:80:27:47:e9:9c:81:c4:61:83:af:
         83:39:35:45:d0:19:a6:81:5b:56:fc:83:81:62:eb:6f:da:4b:
         87:a8:01:6c:64:6d:de:b5:f2:d2:b7:27:e1:91:f6:a9:af:3e:
         14:d9:f3:0c:f7:cb:e9:8a:b2:b9:f3:75:af:8c:c2:80:2a:f2:
         97:c7:39:a5:61:a6:8d:d1:05:e8:fe:72:65:25:4a:a6:62:aa:
         13:4b:66:6f:b3:fd:73:50:4a:f3:ab:7f:be:a4:c2:2c:92:6e:
         4c:bc:11:4b:6b:16:9c:9a:11:50:27:6c:51:7f:3a:84:92:ce:
         0e:5b:03:38:d2:b1:89:1e:8a:6d:77:0d:eb:ba:50:3b:2a:37:
         3c:a0:2f:86:a8:e1:3c:f7:04:e9:4a:8c:10:fb:7a:e6:f5:2c:
         85:21:24:10:3b:68:60:04:33:50:38:5e:c2:d2:40:92:70:c7:
         9f:b1:60:a4:39:60:0c:08:9c:34:94:d6:72:c0:bd:37:90:07:
         f7:03:32:c5:b7:95:70:5e:ef:1b:ad:1a:99:11:d9:16:8e:bf:
         57:97:86:fd:9a:44:88:ae:f4:85:3b:de:be:8e:18:57:3d:c5:
         c1:c4:8e:3c
-----BEGIN CERTIFICATE-----
MIIFpDCCBIygAwIBAgICBu0wDQYJKoZIhvcNAQELBQAwRjERMA8GA1UEAxMIQTkx
NDY5NDQxMTAvBgNVBAUTKEVEMUY5NThDQjYwNEI1NzZFODIyMTRCNENGM0NDMEZF
NjIwRUY5RjQwHhcNMjIwNjI1MjIwMjQxWhcNMjMwODMxMDAwMDAwWjAYMRYwFAYD
VQQDEw02MmI3ODYwMS1hMWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAt95nWWbhzRylUxkRUnSvleQwczGDoiLFVJJ6onutRfGfBRIdMGhAolZReqTZ
jBqPTVO9Ou9uXNrs9TP9sj7Lg7Srt6AS1Lcq95N8M4iuOqEi2fj9nsaxQBfxSS2A
tPAqnTc4zw+CkaB1HrnnoWOeVIAwe0AcEO3KM9eYZyZ0PdtPEP+85oWrXxEwwEo+
WXGuaxmlCg4n5FRcYMzCO1wTq2CPJK6Nee2lu/UZuGLDYBgvBPYPjhmOVFCVi1qg
0/Mbtet4phtX/1C/VlinJ5h/cBgsNEp3WeoRn3i0gPsBXftpEd3bxlrIX0XKSpzG
YhCdpIFRXxweegLsHYkRPrYzUwIDAQABo4ICyDCCAsQwHQYDVR0OBBYEFLNfK2GU
7uXkcG03lIqiQJYER9PyMB8GA1UdIwQYMBaAFO0flYy2BLV26CIUtM88wP5iDvn0
MA4GA1UdDwEB/wQEAwIHgDCBgwYDVR0fBHwwejB4oHagdIZycnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9tZW1iZXJfcmVwb3NpdG9yeS9BOTE0Njk0NC80M0JEMUM2RThF
OTUxMUVBQTlENzNBMkVDNEY5QUUwMi83Ui1WakxZRXRYYm9JaFMwenp6QV9tSU8t
ZlEuY3JsMH4GCCsGAQUFBwEBBHIwcDBuBggrBgEFBQcwAoZicnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9yZXBvc2l0b3J5L0I1MjdFRjU4MUQ2NjExRTJCQjQ2OEY3Qzcy
RkQxRkYyLzdSLVZqTFlFdFhib0loUzB6enpBX21JTy1mUS5jZXIwSgYDVR0gAQH/
BEAwPjA8BggrBgEFBQcOAjAwMC4GCCsGAQUFBwIBFiJodHRwczovL3d3dy5hcG5p
Yy5uZXQvUlBLSS9DUFMucGRmMIHLBggrBgEFBQcBCwSBvjCBuzCBgwYIKwYBBQUH
MAuGd3JzeW5jOi8vcnBraS5hcG5pYy5uZXQvbWVtYmVyX3JlcG9zaXRvcnkvQTkx
NDY5NDQvNDNCRDFDNkU4RTk1MTFFQUE5RDczQTJFQzRGOUFFMDIvQzY4N0JGNDJE
NTAwMTFFQzkxNkI4MzY5QzRGOUFFMDIucm9hMDMGCCsGAQUFBzANhidodHRwczov
L3JyZHAuYXBuaWMubmV0L25vdGlmaWNhdGlvbi54bWwwUgYIKwYBBQUHAQcBAf8E
QzBBMDAEAgABMCoDBAItf/gDBAIt+uQDBAJnx+gDBAJnytwDBAJn0cQDBAHKhVgD
BADKhVswDQQCAAIwBwMFACQDaUAwDQYJKoZIhvcNAQELBQADggEBAIzq8L8c6xnr
ezXOy62PGJZ9wVlNwp0Lm5NjgCdH6ZyBxGGDr4M5NUXQGaaBW1b8g4Fi62/aS4eo
AWxkbd618tK3J+GR9qmvPhTZ8wz3y+mKsrnzda+MwoAq8pfHOaVhpo3RBej+cmUl
SqZiqhNLZm+z/XNQSvOrf76kwiySbky8EUtrFpyaEVAnbFF/OoSSzg5bAzjSsYke
im13Deu6UDsqNzygL4ao4Tz3BOlKjBD7eub1LIUhJBA7aGAEM1A4XsLSQJJwx5+x
YKQ5YAwInDSU1nLAvTeQB/cDMsW3lXBe7xutGpkR2RaOv1eXhv2aRIiu9IU73r6O
GFc9xcHEjjw=
-----END CERTIFICATE-----