Route Origin Authorization

$ rpki-client -vvf rpki.apnic.net/member_repository/A91A001E/35FA0F561D7811E293771FC408B02CD2/8CCBF0A8E03F11EC8F5BA126C4F9AE02.roa
File:                     8CCBF0A8E03F11EC8F5BA126C4F9AE02.roa (raw, json)
Hash identifier:          nEaQfiTZh+OeyQPd6DMRqj8LkijGfSqmVDE0OeFnNwY=
Subject key identifier:   AB:1F:6B:9E:DA:26:5E:53:4F:1E:56:30:19:9D:5B:79:40:5B:6B:57
Certificate issuer:       /CN=A91A001E/serialNumber=8278F47DEC5B7ADC201897F99BCC6E2BFA88D015
Certificate serial:       3AF1
Authority key identifier: 82:78:F4:7D:EC:5B:7A:DC:20:18:97:F9:9B:CC:6E:2B:FA:88:D0:15
Authority info access:    rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/gnj0fexbetwgGJf5m8xuK_qI0BU.cer
Subject info access:      rsync://rpki.apnic.net/member_repository/A91A001E/35FA0F561D7811E293771FC408B02CD2/8CCBF0A8E03F11EC8F5BA126C4F9AE02.roa
Signing time:             Tue 31 May 2022 06:10:11 +0000
ROA not before:           Tue 31 May 2022 06:10:11 +0000
ROA not after:            Fri 30 Sep 2022 00:00:00 +0000
asID:                     3970
IP address blocks:        103.171.218.0/24 maxlen: 24
                          103.171.219.0/24 maxlen: 24
                          2001:df7:5380::/48 maxlen: 48
                          2001:df7:5381::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 15089 (0x3af1)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=A91A001E/serialNumber=8278F47DEC5B7ADC201897F99BCC6E2BFA88D015
        Validity
            Not Before: May 31 06:10:11 2022 GMT
            Not After : Sep 30 00:00:00 2022 GMT
        Subject: CN=6295b141-b38e
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:be:b0:46:c4:ac:c3:d2:ff:05:08:f7:36:78:48:
                    b3:7c:4c:85:4b:c6:46:40:0b:6e:aa:ef:67:47:6c:
                    13:16:14:a8:c2:92:98:7a:76:ed:de:9a:a6:11:d6:
                    e2:3e:2e:b8:1f:4c:7d:46:96:67:8c:58:09:c6:fd:
                    61:22:00:67:dd:91:de:0a:3c:3c:a9:37:8b:a0:d5:
                    12:e2:24:ad:a9:3b:d0:92:ea:b5:b7:e3:fc:f3:38:
                    3a:79:b8:c6:4c:16:d4:92:cd:34:02:ae:f4:3c:7e:
                    56:a6:34:ff:ce:a7:b6:c2:1c:70:a1:a8:7a:c5:bd:
                    9b:5a:17:b1:57:45:8f:6c:cf:45:e9:12:b6:3c:e3:
                    3b:6d:d6:11:ff:0a:84:6a:6f:d4:93:c2:6e:1d:16:
                    b2:fe:55:9a:ca:cd:1f:7a:9c:29:b6:07:1b:bd:81:
                    1c:28:79:35:34:be:44:06:dc:5a:6f:d2:db:64:b7:
                    52:82:ea:e2:92:16:75:d6:59:6b:a8:39:c9:98:f5:
                    47:c3:63:92:49:3a:f9:98:33:eb:20:55:03:8d:e8:
                    39:db:6a:0e:f4:01:2a:7b:38:25:b4:d7:50:73:5c:
                    ae:6c:eb:0e:2a:76:68:73:bd:db:84:d7:3f:81:25:
                    7a:f4:2a:04:0d:95:32:db:3b:01:aa:6f:ea:1a:2a:
                    83:81
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                AB:1F:6B:9E:DA:26:5E:53:4F:1E:56:30:19:9D:5B:79:40:5B:6B:57
            X509v3 Authority Key Identifier:
                keyid:82:78:F4:7D:EC:5B:7A:DC:20:18:97:F9:9B:CC:6E:2B:FA:88:D0:15

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.apnic.net/member_repository/A91A001E/35FA0F561D7811E293771FC408B02CD2/gnj0fexbetwgGJf5m8xuK_qI0BU.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/gnj0fexbetwgGJf5m8xuK_qI0BU.cer

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber
                  CPS: https://www.apnic.net/RPKI/CPS.pdf

            Subject Information Access:
                Signed Object - URI:rsync://rpki.apnic.net/member_repository/A91A001E/35FA0F561D7811E293771FC408B02CD2/8CCBF0A8E03F11EC8F5BA126C4F9AE02.roa
                RPKI Notify - URI:https://rrdp.apnic.net/notification.xml

            sbgp-ipAddrBlock: critical
                IPv4:
                  103.171.218.0/23
                IPv6:
                  2001:df7:5380::/47

    Signature Algorithm: sha256WithRSAEncryption
         a8:61:ca:ae:db:d0:d6:07:a6:e3:2a:5d:97:f2:32:cf:3c:a8:
         69:96:06:63:7a:3c:29:f0:10:e0:13:eb:c0:7c:54:38:c4:37:
         87:bd:68:a3:35:27:86:58:1b:6b:70:d1:76:6d:bf:53:ce:af:
         65:f5:52:5a:b8:5d:10:e4:d1:e1:7a:34:57:00:af:bf:b5:c2:
         ba:40:6e:d5:a0:50:c9:45:54:52:f4:cb:5e:c7:16:18:d4:8f:
         51:d1:a3:5b:8a:03:b1:2e:b1:ca:fb:9a:c4:f3:90:0d:1e:55:
         8d:3b:69:dc:9e:23:e0:8a:bb:76:89:70:ee:28:0c:4a:29:9b:
         20:3b:15:c9:9a:67:fb:4b:a4:39:b2:09:cc:3b:53:00:c6:7d:
         aa:38:6e:36:f1:ab:a7:51:9e:8a:10:c1:43:64:49:5c:07:66:
         98:2d:13:b8:46:32:99:09:6d:86:99:13:d8:ae:f4:bf:41:4a:
         73:bc:c7:61:22:96:bb:e8:5e:7a:41:13:ee:9c:54:91:0a:b0:
         4d:cf:fe:f8:d2:0d:d9:c6:39:e5:88:1c:9e:96:78:85:be:2e:
         91:67:68:56:53:1d:00:9d:7b:45:b3:bc:53:fe:45:2d:74:b8:
         7d:75:65:1b:84:90:0c:1d:19:2c:6d:87:30:4f:c0:9d:90:fa:
         76:db:b4:56
-----BEGIN CERTIFICATE-----
MIIFgjCCBGqgAwIBAgICOvEwDQYJKoZIhvcNAQELBQAwRjERMA8GA1UEAxMIQTkx
QTAwMUUxMTAvBgNVBAUTKDgyNzhGNDdERUM1QjdBREMyMDE4OTdGOTlCQ0M2RTJC
RkE4OEQwMTUwHhcNMjIwNTMxMDYxMDExWhcNMjIwOTMwMDAwMDAwWjAYMRYwFAYD
VQQDEw02Mjk1YjE0MS1iMzhlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAvrBGxKzD0v8FCPc2eEizfEyFS8ZGQAtuqu9nR2wTFhSowpKYenbt3pqmEdbi
Pi64H0x9RpZnjFgJxv1hIgBn3ZHeCjw8qTeLoNUS4iStqTvQkuq1t+P88zg6ebjG
TBbUks00Aq70PH5WpjT/zqe2whxwoah6xb2bWhexV0WPbM9F6RK2POM7bdYR/wqE
am/Uk8JuHRay/lWays0fepwptgcbvYEcKHk1NL5EBtxab9LbZLdSgurikhZ11llr
qDnJmPVHw2OSSTr5mDPrIFUDjeg522oO9AEqezgltNdQc1yubOsOKnZoc73bhNc/
gSV69CoEDZUy2zsBqm/qGiqDgQIDAQABo4ICpjCCAqIwHQYDVR0OBBYEFKsfa57a
Jl5TTx5WMBmdW3lAW2tXMB8GA1UdIwQYMBaAFIJ49H3sW3rcIBiX+ZvMbiv6iNAV
MA4GA1UdDwEB/wQEAwIHgDCBgwYDVR0fBHwwejB4oHagdIZycnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9tZW1iZXJfcmVwb3NpdG9yeS9BOTFBMDAxRS8zNUZBMEY1NjFE
NzgxMUUyOTM3NzFGQzQwOEIwMkNEMi9nbmowZmV4YmV0d2dHSmY1bTh4dUtfcUkw
QlUuY3JsMH4GCCsGAQUFBwEBBHIwcDBuBggrBgEFBQcwAoZicnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9yZXBvc2l0b3J5L0I1MjdFRjU4MUQ2NjExRTJCQjQ2OEY3Qzcy
RkQxRkYyL2duajBmZXhiZXR3Z0dKZjVtOHh1S19xSTBCVS5jZXIwSgYDVR0gAQH/
BEAwPjA8BggrBgEFBQcOAjAwMC4GCCsGAQUFBwIBFiJodHRwczovL3d3dy5hcG5p
Yy5uZXQvUlBLSS9DUFMucGRmMIHLBggrBgEFBQcBCwSBvjCBuzCBgwYIKwYBBQUH
MAuGd3JzeW5jOi8vcnBraS5hcG5pYy5uZXQvbWVtYmVyX3JlcG9zaXRvcnkvQTkx
QTAwMUUvMzVGQTBGNTYxRDc4MTFFMjkzNzcxRkM0MDhCMDJDRDIvOENDQkYwQThF
MDNGMTFFQzhGNUJBMTI2QzRGOUFFMDIucm9hMDMGCCsGAQUFBzANhidodHRwczov
L3JyZHAuYXBuaWMubmV0L25vdGlmaWNhdGlvbi54bWwwMAYIKwYBBQUHAQcBAf8E
ITAfMAwEAgABMAYDBAFnq9owDwQCAAIwCQMHASABDfdTgDANBgkqhkiG9w0BAQsF
AAOCAQEAqGHKrtvQ1gem4ypdl/IyzzyoaZYGY3o8KfAQ4BPrwHxUOMQ3h71oozUn
hlgba3DRdm2/U86vZfVSWrhdEOTR4Xo0VwCvv7XCukBu1aBQyUVUUvTLXscWGNSP
UdGjW4oDsS6xyvuaxPOQDR5VjTtp3J4j4Iq7dolw7igMSimbIDsVyZpn+0ukObIJ
zDtTAMZ9qjhuNvGrp1GeihDBQ2RJXAdmmC0TuEYymQlthpkT2K70v0FKc7zHYSKW
u+heekET7pxUkQqwTc/++NIN2cY55YgcnpZ4hb4ukWdoVlMdAJ17RbO8U/5FLXS4
fXVlG4SQDB0ZLG2HME/AnZD6dtu0Vg==
-----END CERTIFICATE-----