Route Origin Authorization

$ rpki-client -vvf rpki.apnic.net/member_repository/A919B06C/E9D62E74FEAE11E8910D4D66C4F9AE02/DE0FDF4A103411EDBEAC892CC4F9AE02.roa
File:                     DE0FDF4A103411EDBEAC892CC4F9AE02.roa (raw, json)
Hash identifier:          x07SBbBlpi3PN3MsiQR87+4htx6yAQKdLI+OrNHeDZc=
Subject key identifier:   17:D7:79:B6:55:06:80:43:EE:49:39:56:67:97:3A:DD:CF:80:48:22
Certificate issuer:       /CN=A919B06C/serialNumber=C83493C0297CCB58D2837946D6063F14A7DEE986
Certificate serial:       0B7E
Authority key identifier: C8:34:93:C0:29:7C:CB:58:D2:83:79:46:D6:06:3F:14:A7:DE:E9:86
Authority info access:    rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/yDSTwCl8y1jSg3lG1gY_FKfe6YY.cer
Subject info access:      rsync://rpki.apnic.net/member_repository/A919B06C/E9D62E74FEAE11E8910D4D66C4F9AE02/DE0FDF4A103411EDBEAC892CC4F9AE02.roa
Signing time:             Sat 30 Jul 2022 18:24:37 +0000
ROA not before:           Sat 30 Jul 2022 18:24:37 +0000
ROA not after:            Sun 28 May 2023 00:00:00 +0000
asID:                     18230
IP address blocks:        59.152.0.0/20 maxlen: 20
                          59.152.0.0/24 maxlen: 24
                          59.152.1.0/24 maxlen: 24
                          59.152.2.0/24 maxlen: 24
                          59.152.4.0/24 maxlen: 24
                          59.152.5.0/24 maxlen: 24
                          59.152.6.0/24 maxlen: 24
                          59.152.7.0/24 maxlen: 24
                          59.152.8.0/24 maxlen: 24
                          59.152.9.0/24 maxlen: 24
                          59.152.10.0/24 maxlen: 24
                          59.152.12.0/24 maxlen: 24
                          59.152.13.0/24 maxlen: 24
                          203.189.224.0/21 maxlen: 24
                          2404:1b40::/32 maxlen: 32
                          2404:1b40::/48 maxlen: 48
                          2404:1b40:1::/48 maxlen: 48
                          2404:1b40:2::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2942 (0xb7e)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=A919B06C/serialNumber=C83493C0297CCB58D2837946D6063F14A7DEE986
        Validity
            Not Before: Jul 30 18:24:37 2022 GMT
            Not After : May 28 00:00:00 2023 GMT
        Subject: CN=62e57765-3369
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:9e:14:64:20:29:99:49:2d:3f:8e:38:2f:56:b1:
                    56:b4:90:d3:8a:cb:41:a2:aa:db:77:00:57:80:1d:
                    27:b8:35:5c:df:fe:8a:fd:f7:0e:5a:47:b4:8d:34:
                    c6:3d:62:cd:06:23:0a:7b:27:87:94:81:92:62:9c:
                    c9:58:6e:d8:d9:26:1d:09:09:25:10:50:73:25:5c:
                    8b:07:77:78:3c:6b:97:2e:9e:04:f9:e9:3a:66:fb:
                    72:14:2a:a0:33:2a:48:91:98:61:c7:1e:de:7c:1a:
                    cf:4b:2a:dc:37:28:09:9e:db:15:86:14:a2:c9:68:
                    fc:cb:cd:23:f3:7b:1b:25:b8:28:0d:1a:1f:b7:3f:
                    32:aa:28:69:30:ba:a0:7c:eb:f1:f0:c1:42:5a:0c:
                    ed:74:72:a9:06:b3:7c:51:85:71:64:22:a9:e0:f3:
                    fe:13:f7:59:70:70:d0:f7:7e:44:77:ca:b4:12:f6:
                    a8:e6:0a:04:e7:ba:31:b8:46:51:ca:6e:bd:85:76:
                    d8:64:6f:a2:ed:09:98:2a:85:56:b2:68:45:da:f0:
                    d2:67:b8:9b:ab:a6:70:08:b8:4c:49:44:50:4d:92:
                    4c:06:65:78:63:64:60:50:6a:9d:fb:75:69:71:ef:
                    54:b7:cb:97:4a:88:e4:e8:9e:49:d3:1d:92:0d:11:
                    ff:e1
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                17:D7:79:B6:55:06:80:43:EE:49:39:56:67:97:3A:DD:CF:80:48:22
            X509v3 Authority Key Identifier:
                keyid:C8:34:93:C0:29:7C:CB:58:D2:83:79:46:D6:06:3F:14:A7:DE:E9:86

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.apnic.net/member_repository/A919B06C/E9D62E74FEAE11E8910D4D66C4F9AE02/yDSTwCl8y1jSg3lG1gY_FKfe6YY.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/yDSTwCl8y1jSg3lG1gY_FKfe6YY.cer

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber
                  CPS: https://www.apnic.net/RPKI/CPS.pdf

            Subject Information Access:
                Signed Object - URI:rsync://rpki.apnic.net/member_repository/A919B06C/E9D62E74FEAE11E8910D4D66C4F9AE02/DE0FDF4A103411EDBEAC892CC4F9AE02.roa
                RPKI Notify - URI:https://rrdp.apnic.net/notification.xml

            sbgp-ipAddrBlock: critical
                IPv4:
                  59.152.0.0/20
                  203.189.224.0/21
                IPv6:
                  2404:1b40::/32

    Signature Algorithm: sha256WithRSAEncryption
         52:8e:5e:15:2f:e1:2a:a4:81:7a:62:6f:e0:05:99:8c:9d:61:
         51:ff:09:d7:f4:35:9a:33:c6:b1:86:c7:7e:fd:6d:d2:c5:e3:
         33:7c:ba:14:22:58:4f:5e:c9:b9:a6:6f:b7:1e:df:8c:85:d3:
         19:e2:8e:c9:13:4d:13:9a:4a:7c:3f:64:a8:c0:06:44:ff:eb:
         c3:0f:c8:c4:1c:56:8f:5f:7a:4d:e5:93:da:51:3b:97:d5:00:
         5d:63:2f:cc:1c:e7:e6:4a:3f:7a:04:8d:6a:23:e1:c9:0a:c3:
         d0:8b:06:57:31:2a:42:a7:6f:2c:2f:aa:88:93:84:b2:ad:48:
         07:a3:b6:47:ec:de:e8:25:2c:75:17:21:84:30:b2:b2:31:fb:
         23:0f:71:e0:8f:a0:32:58:80:f5:60:70:56:38:ae:19:3f:d2:
         ff:d7:f3:61:24:04:d9:a0:91:09:23:4c:29:5f:43:3c:6d:43:
         70:35:21:d4:36:70:5e:23:59:15:1b:5f:41:c1:6e:40:90:50:
         31:69:ca:5c:16:bc:cb:0d:89:8e:3f:74:fd:bd:5a:3f:9e:bc:
         04:66:17:f3:1a:69:2b:b6:81:d5:f3:24:ea:e4:18:4b:42:94:
         1c:0f:5e:c2:d9:cc:60:af:8a:c1:de:cb:07:21:4c:bf:7c:3d:
         44:93:7c:25
-----BEGIN CERTIFICATE-----
MIIFhjCCBG6gAwIBAgICC34wDQYJKoZIhvcNAQELBQAwRjERMA8GA1UEAxMIQTkx
OUIwNkMxMTAvBgNVBAUTKEM4MzQ5M0MwMjk3Q0NCNThEMjgzNzk0NkQ2MDYzRjE0
QTdERUU5ODYwHhcNMjIwNzMwMTgyNDM3WhcNMjMwNTI4MDAwMDAwWjAYMRYwFAYD
VQQDEw02MmU1Nzc2NS0zMzY5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAnhRkICmZSS0/jjgvVrFWtJDTistBoqrbdwBXgB0nuDVc3/6K/fcOWke0jTTG
PWLNBiMKeyeHlIGSYpzJWG7Y2SYdCQklEFBzJVyLB3d4PGuXLp4E+ek6ZvtyFCqg
MypIkZhhxx7efBrPSyrcNygJntsVhhSiyWj8y80j83sbJbgoDRoftz8yqihpMLqg
fOvx8MFCWgztdHKpBrN8UYVxZCKp4PP+E/dZcHDQ935Ed8q0Evao5goE57oxuEZR
ym69hXbYZG+i7QmYKoVWsmhF2vDSZ7ibq6ZwCLhMSURQTZJMBmV4Y2RgUGqd+3Vp
ce9Ut8uXSojk6J5J0x2SDRH/4QIDAQABo4ICqjCCAqYwHQYDVR0OBBYEFBfXebZV
BoBD7kk5VmeXOt3PgEgiMB8GA1UdIwQYMBaAFMg0k8ApfMtY0oN5RtYGPxSn3umG
MA4GA1UdDwEB/wQEAwIHgDCBgwYDVR0fBHwwejB4oHagdIZycnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9tZW1iZXJfcmVwb3NpdG9yeS9BOTE5QjA2Qy9FOUQ2MkU3NEZF
QUUxMUU4OTEwRDRENjZDNEY5QUUwMi95RFNUd0NsOHkxalNnM2xHMWdZX0ZLZmU2
WVkuY3JsMH4GCCsGAQUFBwEBBHIwcDBuBggrBgEFBQcwAoZicnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9yZXBvc2l0b3J5L0I1MjdFRjU4MUQ2NjExRTJCQjQ2OEY3Qzcy
RkQxRkYyL3lEU1R3Q2w4eTFqU2czbEcxZ1lfRktmZTZZWS5jZXIwSgYDVR0gAQH/
BEAwPjA8BggrBgEFBQcOAjAwMC4GCCsGAQUFBwIBFiJodHRwczovL3d3dy5hcG5p
Yy5uZXQvUlBLSS9DUFMucGRmMIHLBggrBgEFBQcBCwSBvjCBuzCBgwYIKwYBBQUH
MAuGd3JzeW5jOi8vcnBraS5hcG5pYy5uZXQvbWVtYmVyX3JlcG9zaXRvcnkvQTkx
OUIwNkMvRTlENjJFNzRGRUFFMTFFODkxMEQ0RDY2QzRGOUFFMDIvREUwRkRGNEEx
MDM0MTFFREJFQUM4OTJDQzRGOUFFMDIucm9hMDMGCCsGAQUFBzANhidodHRwczov
L3JyZHAuYXBuaWMubmV0L25vdGlmaWNhdGlvbi54bWwwNAYIKwYBBQUHAQcBAf8E
JTAjMBIEAgABMAwDBAQ7mAADBAPLveAwDQQCAAIwBwMFACQEG0AwDQYJKoZIhvcN
AQELBQADggEBAFKOXhUv4SqkgXpib+AFmYydYVH/Cdf0NZozxrGGx379bdLF4zN8
uhQiWE9eybmmb7ce34yF0xnijskTTROaSnw/ZKjABkT/68MPyMQcVo9fek3lk9pR
O5fVAF1jL8wc5+ZKP3oEjWoj4ckKw9CLBlcxKkKnbywvqoiThLKtSAejtkfs3ugl
LHUXIYQwsrIx+yMPceCPoDJYgPVgcFY4rhk/0v/X82EkBNmgkQkjTClfQzxtQ3A1
IdQ2cF4jWRUbX0HBbkCQUDFpylwWvMsNiY4/dP29Wj+evARmF/MaaSu2gdXzJOrk
GEtClBwPXsLZzGCvisHeywchTL98PUSTfCU=
-----END CERTIFICATE-----