Route Origin Authorization

$ rpki-client -vvf rpki.apnic.net/member_repository/A91A001E/35FA0F561D7811E293771FC408B02CD2/E95DD4B2104211ECAD470E81C4F9AE02.roa
File:                     E95DD4B2104211ECAD470E81C4F9AE02.roa (raw, json)
Hash identifier:          32q7jNrSpdNl9V3GOW7F4tDW0WEz7/d6VrE0gjCW5V0=
Subject key identifier:   C0:81:00:05:51:B6:C7:5F:44:DA:5D:52:F0:38:36:98:8F:FE:B4:E2
Certificate issuer:       /CN=A91A001E/serialNumber=8278F47DEC5B7ADC201897F99BCC6E2BFA88D015
Certificate serial:       3DF1
Authority key identifier: 82:78:F4:7D:EC:5B:7A:DC:20:18:97:F9:9B:CC:6E:2B:FA:88:D0:15
Authority info access:    rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/gnj0fexbetwgGJf5m8xuK_qI0BU.cer
Subject info access:      rsync://rpki.apnic.net/member_repository/A91A001E/35FA0F561D7811E293771FC408B02CD2/E95DD4B2104211ECAD470E81C4F9AE02.roa
Signing time:             Sat 12 Aug 2023 14:30:11 +0000
ROA not before:           Sat 12 Aug 2023 14:30:11 +0000
ROA not after:            Mon 30 Sep 2024 00:00:00 +0000
asID:                     666
IP address blocks:        103.171.219.0/24 maxlen: 24
                          2001:df7:5381::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 15857 (0x3df1)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=A91A001E/serialNumber=8278F47DEC5B7ADC201897F99BCC6E2BFA88D015
        Validity
            Not Before: Aug 12 14:30:11 2023 GMT
            Not After : Sep 30 00:00:00 2024 GMT
        Subject: CN=64d79773-490b
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:d9:3e:1a:bc:56:0e:cb:ea:ad:a4:00:da:26:95:
                    32:b0:02:3f:a8:68:e1:11:8e:6b:97:c1:96:45:86:
                    37:ac:21:aa:1e:0e:9a:40:df:0a:39:36:ca:83:fa:
                    5f:3b:80:f3:fd:2b:52:5f:b4:9b:9f:cd:58:e5:32:
                    df:0b:53:ca:90:66:58:0a:78:62:2f:b7:4c:2e:1a:
                    82:6e:ee:f1:9a:f5:8a:89:f9:1a:78:48:5b:ae:37:
                    86:4b:00:c1:47:44:4e:f2:dc:d2:0a:75:b5:a2:28:
                    6a:53:99:4e:87:25:5d:6b:18:2f:16:6b:2e:39:d6:
                    ca:a0:43:47:41:1f:0c:4e:f2:83:82:0d:01:46:6c:
                    8d:3f:13:f9:43:ec:98:f7:62:d4:ad:39:28:3c:ed:
                    3a:2b:62:ba:26:3a:73:9a:d8:c7:1e:41:a9:2b:53:
                    2c:b9:06:ed:1f:28:ea:28:c9:84:b8:1b:d3:22:c5:
                    12:86:49:96:c4:f2:34:16:52:17:ac:4e:63:a0:a5:
                    e9:5d:67:82:f2:83:77:2b:c3:53:77:40:47:17:0a:
                    eb:c0:17:3f:8e:6a:fd:e8:e2:9c:1e:39:ad:4d:fc:
                    65:64:28:7b:30:c7:35:24:cf:a5:52:01:96:08:dc:
                    bc:ff:ac:2f:32:ff:4c:7d:52:aa:f2:2e:f8:89:b2:
                    30:0f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                C0:81:00:05:51:B6:C7:5F:44:DA:5D:52:F0:38:36:98:8F:FE:B4:E2
            X509v3 Authority Key Identifier:
                keyid:82:78:F4:7D:EC:5B:7A:DC:20:18:97:F9:9B:CC:6E:2B:FA:88:D0:15

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.apnic.net/member_repository/A91A001E/35FA0F561D7811E293771FC408B02CD2/gnj0fexbetwgGJf5m8xuK_qI0BU.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/gnj0fexbetwgGJf5m8xuK_qI0BU.cer

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber
                  CPS: https://www.apnic.net/RPKI/CPS.pdf

            Subject Information Access:
                Signed Object - URI:rsync://rpki.apnic.net/member_repository/A91A001E/35FA0F561D7811E293771FC408B02CD2/E95DD4B2104211ECAD470E81C4F9AE02.roa
                RPKI Notify - URI:https://rrdp.apnic.net/notification.xml

            sbgp-ipAddrBlock: critical
                IPv4:
                  103.171.219.0/24
                IPv6:
                  2001:df7:5381::/48

    Signature Algorithm: sha256WithRSAEncryption
         11:59:d5:c7:fc:1f:db:c5:06:53:5e:d6:9e:f3:42:f8:d3:cf:
         78:a2:ad:7b:b5:9a:64:80:e2:9a:56:61:f0:30:a6:5a:9b:b9:
         4c:31:78:81:7e:90:ab:9a:65:a2:16:09:4b:99:a3:74:99:f4:
         ab:97:88:98:2f:70:d5:82:26:ed:54:85:18:fe:7c:dd:6e:f6:
         e6:68:74:40:6e:3d:50:d3:83:06:47:67:ab:64:86:81:08:c6:
         bc:ed:00:7b:cb:e5:b7:b8:a6:5c:32:df:77:d1:e3:78:d5:3c:
         5e:fb:b2:db:b8:69:31:0c:a8:69:eb:d3:50:f1:f6:b7:8a:df:
         b7:e1:19:e2:f6:e7:26:f4:2c:5f:6a:b4:b8:42:ed:d3:eb:47:
         c9:ae:84:1d:75:ae:5a:0e:0d:c1:14:5b:c4:86:2d:68:e2:97:
         7f:2d:dd:aa:46:36:c5:06:86:c9:30:f5:85:20:e6:0e:09:9d:
         2f:f9:69:02:46:47:14:34:0f:fc:72:be:95:73:f4:23:54:b4:
         3f:0b:9d:5f:b5:38:c9:d6:c7:21:a4:3b:ad:8d:64:50:ad:d4:
         85:49:53:43:e0:ff:78:05:85:dd:0c:e9:1a:70:02:d7:3e:bc:
         d2:bd:73:a2:55:fd:5a:a5:b8:af:cb:0b:bf:4a:4c:c3:a7:32:
         2e:01:fc:0c
-----BEGIN CERTIFICATE-----
MIIFgjCCBGqgAwIBAgICPfEwDQYJKoZIhvcNAQELBQAwRjERMA8GA1UEAxMIQTkx
QTAwMUUxMTAvBgNVBAUTKDgyNzhGNDdERUM1QjdBREMyMDE4OTdGOTlCQ0M2RTJC
RkE4OEQwMTUwHhcNMjMwODEyMTQzMDExWhcNMjQwOTMwMDAwMDAwWjAYMRYwFAYD
VQQDEw02NGQ3OTc3My00OTBiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEA2T4avFYOy+qtpADaJpUysAI/qGjhEY5rl8GWRYY3rCGqHg6aQN8KOTbKg/pf
O4Dz/StSX7Sbn81Y5TLfC1PKkGZYCnhiL7dMLhqCbu7xmvWKifkaeEhbrjeGSwDB
R0RO8tzSCnW1oihqU5lOhyVdaxgvFmsuOdbKoENHQR8MTvKDgg0BRmyNPxP5Q+yY
92LUrTkoPO06K2K6JjpzmtjHHkGpK1MsuQbtHyjqKMmEuBvTIsUShkmWxPI0FlIX
rE5joKXpXWeC8oN3K8NTd0BHFwrrwBc/jmr96OKcHjmtTfxlZCh7MMc1JM+lUgGW
CNy8/6wvMv9MfVKq8i74ibIwDwIDAQABo4ICpjCCAqIwHQYDVR0OBBYEFMCBAAVR
tsdfRNpdUvA4NpiP/rTiMB8GA1UdIwQYMBaAFIJ49H3sW3rcIBiX+ZvMbiv6iNAV
MA4GA1UdDwEB/wQEAwIHgDCBgwYDVR0fBHwwejB4oHagdIZycnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9tZW1iZXJfcmVwb3NpdG9yeS9BOTFBMDAxRS8zNUZBMEY1NjFE
NzgxMUUyOTM3NzFGQzQwOEIwMkNEMi9nbmowZmV4YmV0d2dHSmY1bTh4dUtfcUkw
QlUuY3JsMH4GCCsGAQUFBwEBBHIwcDBuBggrBgEFBQcwAoZicnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9yZXBvc2l0b3J5L0I1MjdFRjU4MUQ2NjExRTJCQjQ2OEY3Qzcy
RkQxRkYyL2duajBmZXhiZXR3Z0dKZjVtOHh1S19xSTBCVS5jZXIwSgYDVR0gAQH/
BEAwPjA8BggrBgEFBQcOAjAwMC4GCCsGAQUFBwIBFiJodHRwczovL3d3dy5hcG5p
Yy5uZXQvUlBLSS9DUFMucGRmMIHLBggrBgEFBQcBCwSBvjCBuzCBgwYIKwYBBQUH
MAuGd3JzeW5jOi8vcnBraS5hcG5pYy5uZXQvbWVtYmVyX3JlcG9zaXRvcnkvQTkx
QTAwMUUvMzVGQTBGNTYxRDc4MTFFMjkzNzcxRkM0MDhCMDJDRDIvRTk1REQ0QjIx
MDQyMTFFQ0FENDcwRTgxQzRGOUFFMDIucm9hMDMGCCsGAQUFBzANhidodHRwczov
L3JyZHAuYXBuaWMubmV0L25vdGlmaWNhdGlvbi54bWwwMAYIKwYBBQUHAQcBAf8E
ITAfMAwEAgABMAYDBABnq9swDwQCAAIwCQMHACABDfdTgTANBgkqhkiG9w0BAQsF
AAOCAQEAEVnVx/wf28UGU17WnvNC+NPPeKKte7WaZIDimlZh8DCmWpu5TDF4gX6Q
q5plohYJS5mjdJn0q5eImC9w1YIm7VSFGP583W725mh0QG49UNODBkdnq2SGgQjG
vO0Ae8vlt7imXDLfd9HjeNU8Xvuy27hpMQyoaevTUPH2t4rft+EZ4vbnJvQsX2q0
uELt0+tHya6EHXWuWg4NwRRbxIYtaOKXfy3dqkY2xQaGyTD1hSDmDgmdL/lpAkZH
FDQP/HK+lXP0I1S0PwudX7U4ydbHIaQ7rY1kUK3UhUlTQ+D/eAWF3QzpGnAC1z68
0r1zolX9WqW4r8sLv0pMw6cyLgH8DA==
-----END CERTIFICATE-----