Route Origin Authorization

$ rpki-client -vvf rpki.apnic.net/member_repository/A9155A78/531EA1301D8411E289BB24DA08B02CD2/82D4863EFDFE11EA83B4462DC4F9AE02.roa
File:                     82D4863EFDFE11EA83B4462DC4F9AE02.roa (raw, json)
Hash identifier:          OO7s/W8pIqfrZnWR9YEiUmqs5jgdcL9wEqqUgNfcxLk=
Subject key identifier:   CA:99:FB:B5:07:4C:BC:E0:23:A1:B9:18:40:98:6A:5D:8E:0C:29:80
Certificate issuer:       /CN=A9155A78/serialNumber=20F036CD57187CA29A6FAA9A6A228E20960FDE4F
Certificate serial:       32A1
Authority key identifier: 20:F0:36:CD:57:18:7C:A2:9A:6F:AA:9A:6A:22:8E:20:96:0F:DE:4F
Authority info access:    rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/IPA2zVcYfKKab6qaaiKOIJYP3k8.cer
Subject info access:      rsync://rpki.apnic.net/member_repository/A9155A78/531EA1301D8411E289BB24DA08B02CD2/82D4863EFDFE11EA83B4462DC4F9AE02.roa
Signing time:             Thu 06 Oct 2022 14:40:16 +0000
ROA not before:           Thu 06 Oct 2022 14:40:16 +0000
ROA not after:            Fri 01 Dec 2023 00:00:00 +0000
asID:                     18206
IP address blocks:        115.146.96.0/20 maxlen: 24
                          124.197.224.0/19 maxlen: 24
                          202.162.0.0/19 maxlen: 24
                          202.165.0.0/19 maxlen: 24
                          203.153.80.0/20 maxlen: 24
                          2404:b8::/32 maxlen: 32

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 12961 (0x32a1)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=A9155A78/serialNumber=20F036CD57187CA29A6FAA9A6A228E20960FDE4F
        Validity
            Not Before: Oct  6 14:40:16 2022 GMT
            Not After : Dec  1 00:00:00 2023 GMT
        Subject: CN=633ee8d0-01ca
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ed:59:08:ae:bc:a9:14:da:e9:14:67:83:75:10:
                    a3:1b:22:78:ef:5f:76:80:b5:7c:2c:2b:e3:48:0a:
                    49:06:17:32:3a:53:e2:bf:95:b4:97:d8:45:51:14:
                    ec:ac:01:0e:1a:59:91:1e:7b:14:16:81:18:a8:6b:
                    29:7f:40:94:46:9d:8a:93:21:2e:57:71:95:59:c2:
                    53:16:5c:3a:de:6c:ec:db:94:d5:94:b8:91:4e:b7:
                    c0:42:8c:7d:83:45:a6:36:bf:f8:4a:7d:0f:bc:3c:
                    e1:c5:5d:f7:b1:7f:e6:c2:c9:33:29:9c:c5:23:6a:
                    5b:f9:3c:1c:57:17:71:8c:f6:29:26:48:ce:8d:b6:
                    83:7d:4e:d0:ad:f8:ee:fa:c5:c0:c0:b5:b5:3c:4c:
                    a2:03:95:09:08:d7:93:9e:c7:5d:52:a5:05:fd:96:
                    0f:b9:6a:95:dc:ac:eb:0f:fa:89:c5:90:f4:6a:b7:
                    8a:63:c9:21:f5:b9:11:eb:8f:16:03:29:bc:07:c9:
                    4a:ce:53:22:94:92:9c:7d:00:91:ed:db:e9:f6:00:
                    17:fe:41:f1:a2:cf:f8:ba:ce:b9:0e:8b:9c:72:1a:
                    99:8c:5b:41:c4:72:ef:de:02:a8:13:86:4e:be:37:
                    cb:a3:50:83:97:b6:24:eb:50:78:72:9a:4b:e7:8e:
                    9b:e7
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                CA:99:FB:B5:07:4C:BC:E0:23:A1:B9:18:40:98:6A:5D:8E:0C:29:80
            X509v3 Authority Key Identifier:
                keyid:20:F0:36:CD:57:18:7C:A2:9A:6F:AA:9A:6A:22:8E:20:96:0F:DE:4F

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.apnic.net/member_repository/A9155A78/531EA1301D8411E289BB24DA08B02CD2/IPA2zVcYfKKab6qaaiKOIJYP3k8.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/IPA2zVcYfKKab6qaaiKOIJYP3k8.cer

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber
                  CPS: https://www.apnic.net/RPKI/CPS.pdf

            Subject Information Access:
                Signed Object - URI:rsync://rpki.apnic.net/member_repository/A9155A78/531EA1301D8411E289BB24DA08B02CD2/82D4863EFDFE11EA83B4462DC4F9AE02.roa
                RPKI Notify - URI:https://rrdp.apnic.net/notification.xml

            sbgp-ipAddrBlock: critical
                IPv4:
                  115.146.96.0/20
                  124.197.224.0/19
                  202.162.0.0/19
                  202.165.0.0/19
                  203.153.80.0/20
                IPv6:
                  2404:b8::/32

    Signature Algorithm: sha256WithRSAEncryption
         2a:37:55:df:34:8b:3e:22:3c:32:de:30:17:2d:20:02:bf:e0:
         6c:66:23:87:5f:9c:ed:2f:04:dd:d1:bc:0a:18:77:44:ca:18:
         b5:b1:bf:9c:50:79:86:3e:25:00:87:53:25:43:cd:53:15:3b:
         f9:ea:46:79:5f:6d:83:b4:fc:09:d0:dc:e1:c1:0a:27:25:c0:
         5b:41:b8:b1:4e:6d:0a:3a:64:93:47:2d:a2:95:ce:b9:ee:2d:
         81:01:55:26:7e:af:cf:bf:c1:8b:86:02:15:e8:cc:2a:22:9d:
         d5:0f:b2:79:fb:4d:95:67:47:1b:00:12:56:43:de:ab:13:7e:
         e2:e1:19:b8:9b:88:7e:d7:bc:e9:91:ea:03:71:a9:98:42:5c:
         f0:6b:45:b7:85:43:b1:02:30:38:ea:6a:4d:fd:4c:de:6f:93:
         a0:39:88:ce:c1:dc:e9:e1:e7:c8:71:81:e7:69:f1:29:04:ec:
         33:6f:d2:86:9f:62:7f:c8:c2:9d:a5:87:43:6b:31:3c:31:e8:
         ec:fc:dd:40:28:ae:e0:04:54:7d:87:39:fa:5c:b4:54:90:2b:
         f2:fb:50:bf:11:12:90:00:8d:17:bf:25:ac:52:27:cb:ae:40:
         84:1b:85:a6:4e:db:bc:35:af:92:15:55:42:19:42:22:33:ed:
         30:13:14:cf
-----BEGIN CERTIFICATE-----
MIIFmDCCBICgAwIBAgICMqEwDQYJKoZIhvcNAQELBQAwRjERMA8GA1UEAxMIQTkx
NTVBNzgxMTAvBgNVBAUTKDIwRjAzNkNENTcxODdDQTI5QTZGQUE5QTZBMjI4RTIw
OTYwRkRFNEYwHhcNMjIxMDA2MTQ0MDE2WhcNMjMxMjAxMDAwMDAwWjAYMRYwFAYD
VQQDEw02MzNlZThkMC0wMWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEA7VkIrrypFNrpFGeDdRCjGyJ47192gLV8LCvjSApJBhcyOlPiv5W0l9hFURTs
rAEOGlmRHnsUFoEYqGspf0CURp2KkyEuV3GVWcJTFlw63mzs25TVlLiRTrfAQox9
g0WmNr/4Sn0PvDzhxV33sX/mwskzKZzFI2pb+TwcVxdxjPYpJkjOjbaDfU7Qrfju
+sXAwLW1PEyiA5UJCNeTnsddUqUF/ZYPuWqV3KzrD/qJxZD0areKY8kh9bkR648W
Aym8B8lKzlMilJKcfQCR7dvp9gAX/kHxos/4us65DoucchqZjFtBxHLv3gKoE4ZO
vjfLo1CDl7Yk61B4cppL546b5wIDAQABo4ICvDCCArgwHQYDVR0OBBYEFMqZ+7UH
TLzgI6G5GECYal2ODCmAMB8GA1UdIwQYMBaAFCDwNs1XGHyimm+qmmoijiCWD95P
MA4GA1UdDwEB/wQEAwIHgDCBgwYDVR0fBHwwejB4oHagdIZycnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9tZW1iZXJfcmVwb3NpdG9yeS9BOTE1NUE3OC81MzFFQTEzMDFE
ODQxMUUyODlCQjI0REEwOEIwMkNEMi9JUEEyelZjWWZLS2FiNnFhYWlLT0lKWVAz
azguY3JsMH4GCCsGAQUFBwEBBHIwcDBuBggrBgEFBQcwAoZicnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9yZXBvc2l0b3J5L0I1MjdFRjU4MUQ2NjExRTJCQjQ2OEY3Qzcy
RkQxRkYyL0lQQTJ6VmNZZktLYWI2cWFhaUtPSUpZUDNrOC5jZXIwSgYDVR0gAQH/
BEAwPjA8BggrBgEFBQcOAjAwMC4GCCsGAQUFBwIBFiJodHRwczovL3d3dy5hcG5p
Yy5uZXQvUlBLSS9DUFMucGRmMIHLBggrBgEFBQcBCwSBvjCBuzCBgwYIKwYBBQUH
MAuGd3JzeW5jOi8vcnBraS5hcG5pYy5uZXQvbWVtYmVyX3JlcG9zaXRvcnkvQTkx
NTVBNzgvNTMxRUExMzAxRDg0MTFFMjg5QkIyNERBMDhCMDJDRDIvODJENDg2M0VG
REZFMTFFQTgzQjQ0NjJEQzRGOUFFMDIucm9hMDMGCCsGAQUFBzANhidodHRwczov
L3JyZHAuYXBuaWMubmV0L25vdGlmaWNhdGlvbi54bWwwRgYIKwYBBQUHAQcBAf8E
NzA1MCQEAgABMB4DBARzkmADBAV8xeADBAXKogADBAXKpQADBATLmVAwDQQCAAIw
BwMFACQEALgwDQYJKoZIhvcNAQELBQADggEBACo3Vd80iz4iPDLeMBctIAK/4Gxm
I4dfnO0vBN3RvAoYd0TKGLWxv5xQeYY+JQCHUyVDzVMVO/nqRnlfbYO0/AnQ3OHB
CiclwFtBuLFObQo6ZJNHLaKVzrnuLYEBVSZ+r8+/wYuGAhXozCoindUPsnn7TZVn
RxsAElZD3qsTfuLhGbibiH7XvOmR6gNxqZhCXPBrRbeFQ7ECMDjqak39TN5vk6A5
iM7B3Onh58hxgedp8SkE7DNv0oafYn/Iwp2lh0NrMTwx6Oz83UAoruAEVH2HOfpc
tFSQK/L7UL8REpAAjRe/JaxSJ8uuQIQbhaZO27w1r5IVVUIZQiIz7TATFM8=
-----END CERTIFICATE-----