Route Origin Authorization

$ rpki-client -vvf rpki.apnic.net/member_repository/A918EDB2/2A43E30C70E911E2B36D4B6B2979BB20/8796D680C38911EB83FA2A78C4F9AE02.roa
File:                     8796D680C38911EB83FA2A78C4F9AE02.roa (raw, json)
Hash identifier:          r+5kCfSFqpq7Ijp5xVn525DFUHp6J6TGBOLqBMkG7hE=
Subject key identifier:   FE:7B:D0:1F:4F:61:4A:D3:87:96:88:C6:35:A6:0B:0C:28:31:81:59
Certificate issuer:       /CN=A918EDB2/serialNumber=296EDB64F3AF6E9D980932E816F95983E3ABC823
Certificate serial:       3C7D
Authority key identifier: 29:6E:DB:64:F3:AF:6E:9D:98:09:32:E8:16:F9:59:83:E3:AB:C8:23
Authority info access:    rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/KW7bZPOvbp2YCTLoFvlZg-OryCM.cer
Subject info access:      rsync://rpki.apnic.net/member_repository/A918EDB2/2A43E30C70E911E2B36D4B6B2979BB20/8796D680C38911EB83FA2A78C4F9AE02.roa
Signing time:             Tue 07 Sep 2021 07:42:21 +0000
ROA not before:           Tue 07 Sep 2021 07:42:21 +0000
ROA not after:            Fri 01 Jul 2022 00:00:00 +0000
asID:                     134864
IP address blocks:        45.250.216.0/22 maxlen: 24
                          103.69.4.0/22 maxlen: 24
                          103.219.136.0/22 maxlen: 24

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 15485 (0x3c7d)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=A918EDB2/serialNumber=296EDB64F3AF6E9D980932E816F95983E3ABC823
        Validity
            Not Before: Sep  7 07:42:21 2021 GMT
            Not After : Jul  1 00:00:00 2022 GMT
        Subject: CN=613717dd-beba
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:cd:18:08:88:76:ea:8b:6d:c8:af:16:8b:e8:ed:
                    b8:12:8b:6b:f9:43:e8:e2:ab:81:cd:29:6b:5c:d2:
                    89:ae:88:97:ef:91:19:30:23:f4:ed:a5:ea:55:2c:
                    31:af:50:ec:ff:02:62:d5:ef:76:f0:ff:7c:22:70:
                    e5:82:d6:e8:33:9f:a4:ab:44:cb:11:5e:f9:bc:52:
                    ff:fc:06:89:35:6e:d0:2e:dc:90:42:e6:ef:b1:27:
                    3e:82:f8:56:73:82:58:4c:6d:56:85:2f:26:fc:ba:
                    27:e9:17:d6:0f:17:27:3a:b5:30:77:77:e4:55:78:
                    d4:3f:88:5d:bc:bd:37:1c:5b:6d:ab:f3:ad:03:18:
                    19:fc:75:56:3b:2f:ca:44:58:54:5a:5f:51:4f:87:
                    b5:44:f6:cd:7d:4c:fc:0c:42:44:d0:58:65:53:d3:
                    9a:36:bc:8e:3b:ca:70:51:de:09:37:6d:74:a6:66:
                    1f:b5:66:85:53:11:4a:4c:0c:9d:ee:9b:f9:cb:c2:
                    0c:c5:7a:75:8b:1a:ed:9c:92:7c:df:c4:58:6d:18:
                    8e:7d:c9:a1:03:eb:e1:d0:ea:9f:76:ee:7b:19:45:
                    7f:c9:d7:50:35:76:dc:de:82:7e:89:e2:b9:cb:5d:
                    9e:c5:33:66:d8:e0:36:08:03:aa:25:9b:c6:31:1e:
                    4c:6f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                FE:7B:D0:1F:4F:61:4A:D3:87:96:88:C6:35:A6:0B:0C:28:31:81:59
            X509v3 Authority Key Identifier:
                keyid:29:6E:DB:64:F3:AF:6E:9D:98:09:32:E8:16:F9:59:83:E3:AB:C8:23

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.apnic.net/member_repository/A918EDB2/2A43E30C70E911E2B36D4B6B2979BB20/KW7bZPOvbp2YCTLoFvlZg-OryCM.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/KW7bZPOvbp2YCTLoFvlZg-OryCM.cer

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber
                  CPS: https://www.apnic.net/RPKI/CPS.pdf

            Subject Information Access:
                Signed Object - URI:rsync://rpki.apnic.net/member_repository/A918EDB2/2A43E30C70E911E2B36D4B6B2979BB20/8796D680C38911EB83FA2A78C4F9AE02.roa
                RPKI Notify - URI:https://rrdp.apnic.net/notification.xml

            sbgp-ipAddrBlock: critical
                IPv4:
                  45.250.216.0/22
                  103.69.4.0/22
                  103.219.136.0/22

    Signature Algorithm: sha256WithRSAEncryption
         ab:c1:ad:01:c4:68:a0:6e:8e:6b:51:28:dd:58:1f:9c:84:cb:
         e5:bf:f1:8e:63:be:84:54:a4:21:18:e3:24:b6:d0:34:68:08:
         9e:e2:e2:5e:76:54:44:ca:09:1f:d0:ca:c3:1e:7c:02:21:b1:
         29:9e:10:53:79:c2:bb:c6:49:d2:06:51:52:24:c5:58:d4:6f:
         96:fb:2a:a4:84:b3:63:3e:48:d6:e3:fb:6e:07:ab:21:95:08:
         01:39:25:b9:b8:73:7e:8f:f5:bf:0b:d8:5b:d1:15:ab:f4:86:
         c2:42:17:75:b7:ed:38:75:5f:04:35:88:1e:1a:c7:05:cc:13:
         e3:c1:55:c4:8b:14:bb:9c:78:fd:d7:dc:7f:f6:9e:45:1c:43:
         e2:22:61:21:90:81:00:32:9b:70:75:3f:03:5e:83:5d:07:1a:
         34:9e:9e:9c:0a:72:2a:2d:aa:49:0d:33:01:60:32:16:9d:c8:
         1d:00:04:96:04:ba:91:9b:dd:9d:f0:09:f7:4a:9f:94:bc:1d:
         70:bc:f2:0f:33:36:60:42:c1:68:df:5f:a1:45:bd:af:9d:3e:
         bd:45:c7:a9:c3:bd:2a:14:cd:2b:47:0e:00:91:83:0b:bd:36:
         df:1b:69:e6:b9:d8:0c:6e:cd:4f:41:36:c4:b5:8b:d1:73:17:
         fd:b1:ca:27
-----BEGIN CERTIFICATE-----
MIIFfTCCBGWgAwIBAgICPH0wDQYJKoZIhvcNAQELBQAwRjERMA8GA1UEAxMIQTkx
OEVEQjIxMTAvBgNVBAUTKDI5NkVEQjY0RjNBRjZFOUQ5ODA5MzJFODE2Rjk1OTgz
RTNBQkM4MjMwHhcNMjEwOTA3MDc0MjIxWhcNMjIwNzAxMDAwMDAwWjAYMRYwFAYD
VQQDEw02MTM3MTdkZC1iZWJhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAzRgIiHbqi23IrxaL6O24Eotr+UPo4quBzSlrXNKJroiX75EZMCP07aXqVSwx
r1Ds/wJi1e928P98InDlgtboM5+kq0TLEV75vFL//AaJNW7QLtyQQubvsSc+gvhW
c4JYTG1WhS8m/Lon6RfWDxcnOrUwd3fkVXjUP4hdvL03HFttq/OtAxgZ/HVWOy/K
RFhUWl9RT4e1RPbNfUz8DEJE0FhlU9OaNryOO8pwUd4JN210pmYftWaFUxFKTAyd
7pv5y8IMxXp1ixrtnJJ838RYbRiOfcmhA+vh0Oqfdu57GUV/yddQNXbc3oJ+ieK5
y12exTNm2OA2CAOqJZvGMR5MbwIDAQABo4ICoTCCAp0wHQYDVR0OBBYEFP570B9P
YUrTh5aIxjWmCwwoMYFZMB8GA1UdIwQYMBaAFClu22Tzr26dmAky6Bb5WYPjq8gj
MA4GA1UdDwEB/wQEAwIHgDCBgwYDVR0fBHwwejB4oHagdIZycnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9tZW1iZXJfcmVwb3NpdG9yeS9BOTE4RURCMi8yQTQzRTMwQzcw
RTkxMUUyQjM2RDRCNkIyOTc5QkIyMC9LVzdiWlBPdmJwMllDVExvRnZsWmctT3J5
Q00uY3JsMH4GCCsGAQUFBwEBBHIwcDBuBggrBgEFBQcwAoZicnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9yZXBvc2l0b3J5L0I1MjdFRjU4MUQ2NjExRTJCQjQ2OEY3Qzcy
RkQxRkYyL0tXN2JaUE92YnAyWUNUTG9GdmxaZy1PcnlDTS5jZXIwSgYDVR0gAQH/
BEAwPjA8BggrBgEFBQcOAjAwMC4GCCsGAQUFBwIBFiJodHRwczovL3d3dy5hcG5p
Yy5uZXQvUlBLSS9DUFMucGRmMIHLBggrBgEFBQcBCwSBvjCBuzCBgwYIKwYBBQUH
MAuGd3JzeW5jOi8vcnBraS5hcG5pYy5uZXQvbWVtYmVyX3JlcG9zaXRvcnkvQTkx
OEVEQjIvMkE0M0UzMEM3MEU5MTFFMkIzNkQ0QjZCMjk3OUJCMjAvODc5NkQ2ODBD
Mzg5MTFFQjgzRkEyQTc4QzRGOUFFMDIucm9hMDMGCCsGAQUFBzANhidodHRwczov
L3JyZHAuYXBuaWMubmV0L25vdGlmaWNhdGlvbi54bWwwKwYIKwYBBQUHAQcBAf8E
HDAaMBgEAgABMBIDBAIt+tgDBAJnRQQDBAJn24gwDQYJKoZIhvcNAQELBQADggEB
AKvBrQHEaKBujmtRKN1YH5yEy+W/8Y5jvoRUpCEY4yS20DRoCJ7i4l52VETKCR/Q
ysMefAIhsSmeEFN5wrvGSdIGUVIkxVjUb5b7KqSEs2M+SNbj+24HqyGVCAE5Jbm4
c36P9b8L2FvRFav0hsJCF3W37Th1XwQ1iB4axwXME+PBVcSLFLuceP3X3H/2nkUc
Q+IiYSGQgQAym3B1PwNeg10HGjSenpwKciotqkkNMwFgMhadyB0ABJYEupGb3Z3w
CfdKn5S8HXC88g8zNmBCwWjfX6FFva+dPr1Fx6nDvSoUzStHDgCRgwu9Nt8baea5
2AxuzU9BNsS1i9FzF/2xyic=
-----END CERTIFICATE-----