Route Origin Authorization

$ rpki-client -vvf rpki.apnic.net/member_repository/A91597D0/CD4572203DB311EA8BF93A0EC4F9AE02/840065DCABF911ECB9A3FA39C4F9AE02.roa
File:                     840065DCABF911ECB9A3FA39C4F9AE02.roa (raw, json)
Hash identifier:          HRsJeSaiaYei/IqThjE50pxxrUYq++NQsFNuArYWMIk=
Subject key identifier:   D0:05:19:B1:D2:A1:B1:CF:A9:52:92:AB:EE:7E:3D:7D:A7:C5:45:E3
Certificate issuer:       /CN=A91597D0/serialNumber=314246901FA7D6505D97AA1C0140BBCA0E8C294F
Certificate serial:       0967
Authority key identifier: 31:42:46:90:1F:A7:D6:50:5D:97:AA:1C:01:40:BB:CA:0E:8C:29:4F
Authority info access:    rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/MUJGkB-n1lBdl6ocAUC7yg6MKU8.cer
Subject info access:      rsync://rpki.apnic.net/member_repository/A91597D0/CD4572203DB311EA8BF93A0EC4F9AE02/840065DCABF911ECB9A3FA39C4F9AE02.roa
Signing time:             Sat 31 Dec 2022 21:17:30 +0000
ROA not before:           Sat 31 Dec 2022 21:17:30 +0000
ROA not after:            Mon 01 May 2023 00:00:00 +0000
asID:                     134824
IP address blocks:        103.202.52.0/22 maxlen: 24
                          2404:c180::/32 maxlen: 32
                          2404:c180:2000::/36 maxlen: 36
                          2404:c180:3000::/36 maxlen: 36
                          2404:c180:4000::/34 maxlen: 36
                          2404:c180:8000::/33 maxlen: 36

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2407 (0x967)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=A91597D0/serialNumber=314246901FA7D6505D97AA1C0140BBCA0E8C294F
        Validity
            Not Before: Dec 31 21:17:30 2022 GMT
            Not After : May  1 00:00:00 2023 GMT
        Subject: CN=63b0a6e9-958e
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:c8:fa:7c:44:3c:b0:c5:c3:0a:ec:2f:78:8f:ea:
                    35:91:e7:86:32:2f:b6:af:0d:bc:06:35:ce:1d:5e:
                    89:41:d7:e3:d0:31:ec:ef:48:2c:00:f9:9b:a5:6f:
                    9c:84:a3:bc:c0:62:90:b5:e2:6d:29:3a:ba:48:a1:
                    46:bb:d6:d8:55:a7:10:c0:46:e1:bf:76:05:bb:61:
                    9a:7e:74:f4:32:d9:41:9e:f1:a2:0a:54:c4:03:c7:
                    e1:fd:81:fd:51:c8:15:31:94:a2:50:aa:60:84:1f:
                    22:49:a8:c7:f0:fd:dc:8a:7c:14:6b:9f:5f:a1:0a:
                    3b:6f:42:54:bd:00:2f:fa:0d:1b:13:2e:34:0b:81:
                    fc:d8:5a:7d:ce:8b:22:3a:65:a2:83:9d:d2:07:fa:
                    9e:55:03:69:94:0e:ef:04:da:8e:3f:36:ec:db:1c:
                    76:26:6a:2f:5b:cb:7c:cb:31:b7:3c:0c:91:90:31:
                    0e:38:84:a0:76:95:ad:43:bb:3e:96:3f:25:c3:bd:
                    e6:9c:c5:63:70:fb:70:88:b4:e9:eb:04:55:92:0f:
                    00:d5:c9:89:5f:e9:87:d5:23:1e:de:a4:19:ff:21:
                    40:72:ce:20:17:46:fc:af:3f:8c:9b:dd:4a:ad:67:
                    80:18:7b:1c:9f:64:0f:a6:6d:8b:90:1e:ed:a0:87:
                    c5:09
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D0:05:19:B1:D2:A1:B1:CF:A9:52:92:AB:EE:7E:3D:7D:A7:C5:45:E3
            X509v3 Authority Key Identifier:
                keyid:31:42:46:90:1F:A7:D6:50:5D:97:AA:1C:01:40:BB:CA:0E:8C:29:4F

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.apnic.net/member_repository/A91597D0/CD4572203DB311EA8BF93A0EC4F9AE02/MUJGkB-n1lBdl6ocAUC7yg6MKU8.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/MUJGkB-n1lBdl6ocAUC7yg6MKU8.cer

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber
                  CPS: https://www.apnic.net/RPKI/CPS.pdf

            Subject Information Access:
                Signed Object - URI:rsync://rpki.apnic.net/member_repository/A91597D0/CD4572203DB311EA8BF93A0EC4F9AE02/840065DCABF911ECB9A3FA39C4F9AE02.roa
                RPKI Notify - URI:https://rrdp.apnic.net/notification.xml

            sbgp-ipAddrBlock: critical
                IPv4:
                  103.202.52.0/22
                IPv6:
                  2404:c180::/32

    Signature Algorithm: sha256WithRSAEncryption
         4f:50:91:4b:e1:cc:d5:30:e5:6d:3a:83:c8:9b:ab:08:67:16:
         41:42:15:59:4f:6a:1e:ed:2d:42:18:5c:58:08:1c:6a:31:ee:
         d9:71:a9:6b:bb:89:99:27:62:35:70:7d:fd:35:ad:87:44:2c:
         40:c1:4d:b4:4c:66:bd:8b:f7:94:0d:56:7f:ea:65:2f:e9:e7:
         a4:8c:3f:40:09:79:85:60:d1:bd:e9:67:69:3d:93:4b:f3:1d:
         21:0f:85:1a:80:42:f4:15:c7:1c:63:32:dc:1c:fa:f9:2c:9d:
         b4:2a:1e:17:fa:2b:ed:d4:fb:5d:1d:43:c5:cb:35:e6:ce:ef:
         f9:a7:6f:83:a9:a5:3b:33:a8:9f:00:ba:b3:8a:18:18:28:24:
         6f:1a:4e:fb:f0:e6:d8:57:09:e0:ac:d1:0b:8c:25:f2:77:49:
         8e:95:f1:d2:88:cd:0e:52:54:4c:71:3b:52:6d:6a:7d:32:d0:
         b1:29:98:a0:fe:ff:cd:b4:13:05:d6:39:1b:73:f8:c4:c5:4e:
         9d:07:43:da:39:c0:36:35:42:34:9e:bf:3b:5e:33:d0:b9:87:
         2b:8e:19:9a:18:92:04:07:a0:e9:95:cd:2d:72:77:76:a2:23:
         fa:4f:f1:1b:98:80:69:a2:fe:7c:39:96:29:65:e7:c9:80:4d:
         cb:b4:ec:98
-----BEGIN CERTIFICATE-----
MIIFgDCCBGigAwIBAgICCWcwDQYJKoZIhvcNAQELBQAwRjERMA8GA1UEAxMIQTkx
NTk3RDAxMTAvBgNVBAUTKDMxNDI0NjkwMUZBN0Q2NTA1RDk3QUExQzAxNDBCQkNB
MEU4QzI5NEYwHhcNMjIxMjMxMjExNzMwWhcNMjMwNTAxMDAwMDAwWjAYMRYwFAYD
VQQDEw02M2IwYTZlOS05NThlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAyPp8RDywxcMK7C94j+o1keeGMi+2rw28BjXOHV6JQdfj0DHs70gsAPmbpW+c
hKO8wGKQteJtKTq6SKFGu9bYVacQwEbhv3YFu2GafnT0MtlBnvGiClTEA8fh/YH9
UcgVMZSiUKpghB8iSajH8P3cinwUa59foQo7b0JUvQAv+g0bEy40C4H82Fp9zosi
OmWig53SB/qeVQNplA7vBNqOPzbs2xx2JmovW8t8yzG3PAyRkDEOOISgdpWtQ7s+
lj8lw73mnMVjcPtwiLTp6wRVkg8A1cmJX+mH1SMe3qQZ/yFAcs4gF0b8rz+Mm91K
rWeAGHscn2QPpm2LkB7toIfFCQIDAQABo4ICpDCCAqAwHQYDVR0OBBYEFNAFGbHS
obHPqVKSq+5+PX2nxUXjMB8GA1UdIwQYMBaAFDFCRpAfp9ZQXZeqHAFAu8oOjClP
MA4GA1UdDwEB/wQEAwIHgDCBgwYDVR0fBHwwejB4oHagdIZycnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9tZW1iZXJfcmVwb3NpdG9yeS9BOTE1OTdEMC9DRDQ1NzIyMDNE
QjMxMUVBOEJGOTNBMEVDNEY5QUUwMi9NVUpHa0ItbjFsQmRsNm9jQVVDN3lnNk1L
VTguY3JsMH4GCCsGAQUFBwEBBHIwcDBuBggrBgEFBQcwAoZicnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9yZXBvc2l0b3J5L0I1MjdFRjU4MUQ2NjExRTJCQjQ2OEY3Qzcy
RkQxRkYyL01VSkdrQi1uMWxCZGw2b2NBVUM3eWc2TUtVOC5jZXIwSgYDVR0gAQH/
BEAwPjA8BggrBgEFBQcOAjAwMC4GCCsGAQUFBwIBFiJodHRwczovL3d3dy5hcG5p
Yy5uZXQvUlBLSS9DUFMucGRmMIHLBggrBgEFBQcBCwSBvjCBuzCBgwYIKwYBBQUH
MAuGd3JzeW5jOi8vcnBraS5hcG5pYy5uZXQvbWVtYmVyX3JlcG9zaXRvcnkvQTkx
NTk3RDAvQ0Q0NTcyMjAzREIzMTFFQThCRjkzQTBFQzRGOUFFMDIvODQwMDY1RENB
QkY5MTFFQ0I5QTNGQTM5QzRGOUFFMDIucm9hMDMGCCsGAQUFBzANhidodHRwczov
L3JyZHAuYXBuaWMubmV0L25vdGlmaWNhdGlvbi54bWwwLgYIKwYBBQUHAQcBAf8E
HzAdMAwEAgABMAYDBAJnyjQwDQQCAAIwBwMFACQEwYAwDQYJKoZIhvcNAQELBQAD
ggEBAE9QkUvhzNUw5W06g8ibqwhnFkFCFVlPah7tLUIYXFgIHGox7tlxqWu7iZkn
YjVwff01rYdELEDBTbRMZr2L95QNVn/qZS/p56SMP0AJeYVg0b3pZ2k9k0vzHSEP
hRqAQvQVxxxjMtwc+vksnbQqHhf6K+3U+10dQ8XLNebO7/mnb4OppTszqJ8AurOK
GBgoJG8aTvvw5thXCeCs0QuMJfJ3SY6V8dKIzQ5SVExxO1Jtan0y0LEpmKD+/820
EwXWORtz+MTFTp0HQ9o5wDY1QjSevzteM9C5hyuOGZoYkgQHoOmVzS1yd3aiI/pP
8RuYgGmi/nw5lill58mATcu07Jg=
-----END CERTIFICATE-----