Route Origin Authorization

$ rpki-client -vvf rpki.apnic.net/member_repository/A91B0BAB/602C66547B1511EAA5A4A869C4F9AE02/53E6D3044A8911EB94CBBC50C4F9AE02.roa
File:                     53E6D3044A8911EB94CBBC50C4F9AE02.roa (raw, json)
Hash identifier:          lT/adNGuQOpRsgQGLgVu4JNA+ncR07W6KnSuIGNjia0=
Subject key identifier:   E0:4D:CF:02:4B:81:AA:64:96:D6:6A:32:9A:22:68:EE:89:B7:2F:02
Certificate issuer:       /CN=A91B0BAB/serialNumber=81F467ADC317D16348AF43304B0441443A1FE32C
Certificate serial:       05D1
Authority key identifier: 81:F4:67:AD:C3:17:D1:63:48:AF:43:30:4B:04:41:44:3A:1F:E3:2C
Authority info access:    rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/gfRnrcMX0WNIr0MwSwRBRDof4yw.cer
Subject info access:      rsync://rpki.apnic.net/member_repository/A91B0BAB/602C66547B1511EAA5A4A869C4F9AE02/53E6D3044A8911EB94CBBC50C4F9AE02.roa
Signing time:             Tue 24 Oct 2023 20:48:39 +0000
ROA not before:           Tue 24 Oct 2023 20:48:39 +0000
ROA not after:            Sun 01 Dec 2024 00:00:00 +0000
asID:                     138185
IP address blocks:        103.129.132.0/22 maxlen: 24
                          2403:7e40::/32 maxlen: 36

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1489 (0x5d1)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=A91B0BAB/serialNumber=81F467ADC317D16348AF43304B0441443A1FE32C
        Validity
            Not Before: Oct 24 20:48:39 2023 GMT
            Not After : Dec  1 00:00:00 2024 GMT
        Subject: CN=65382da7-567f
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b6:85:08:17:ae:19:01:60:e5:61:f0:f4:4a:34:
                    3d:46:b0:6c:0b:eb:6a:16:e1:8c:74:52:71:77:29:
                    d0:73:64:ff:40:f3:47:b4:9a:e2:63:2a:11:e4:6d:
                    b4:14:d8:ec:d1:b9:c0:9f:2a:1e:80:98:75:7b:67:
                    42:eb:92:77:8f:a8:6e:10:38:32:f1:25:f7:6a:39:
                    d5:f6:68:16:a9:f7:e1:eb:ea:1b:9c:96:41:20:c9:
                    34:fb:b0:17:03:ee:76:62:bb:da:a1:ac:eb:84:d7:
                    2f:47:4c:32:78:73:67:98:92:1a:e5:ae:d4:47:52:
                    3b:45:3b:a0:ee:2d:2a:6c:cf:a5:c2:fb:40:d3:08:
                    41:a4:e7:37:70:57:37:d4:a1:4d:f1:0b:b4:5f:78:
                    23:44:81:60:75:9a:00:4e:b3:2c:07:1d:13:d5:4b:
                    8d:41:4f:cb:75:0b:8a:0b:4c:c7:e8:04:da:4d:9f:
                    0f:5a:a8:bb:97:83:5d:16:39:51:d7:b5:ec:d4:ce:
                    58:1b:ca:47:36:17:d0:39:a0:d8:6d:95:7a:ed:a4:
                    9e:89:21:b8:d9:4c:82:4b:0a:77:d8:d2:1d:62:55:
                    ee:46:9f:88:86:d0:ef:12:4f:d4:fc:89:d0:42:7c:
                    84:80:45:02:31:fe:c4:dd:09:97:70:3f:bf:9c:68:
                    08:09
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                E0:4D:CF:02:4B:81:AA:64:96:D6:6A:32:9A:22:68:EE:89:B7:2F:02
            X509v3 Authority Key Identifier:
                keyid:81:F4:67:AD:C3:17:D1:63:48:AF:43:30:4B:04:41:44:3A:1F:E3:2C

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.apnic.net/member_repository/A91B0BAB/602C66547B1511EAA5A4A869C4F9AE02/gfRnrcMX0WNIr0MwSwRBRDof4yw.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/gfRnrcMX0WNIr0MwSwRBRDof4yw.cer

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber
                  CPS: https://www.apnic.net/RPKI/CPS.pdf

            Subject Information Access:
                Signed Object - URI:rsync://rpki.apnic.net/member_repository/A91B0BAB/602C66547B1511EAA5A4A869C4F9AE02/53E6D3044A8911EB94CBBC50C4F9AE02.roa
                RPKI Notify - URI:https://rrdp.apnic.net/notification.xml

            sbgp-ipAddrBlock: critical
                IPv4:
                  103.129.132.0/22
                IPv6:
                  2403:7e40::/32

    Signature Algorithm: sha256WithRSAEncryption
         19:c6:4b:ba:c7:5e:42:01:5a:a1:2c:ee:f8:1a:78:3b:dd:ff:
         b0:11:91:5f:ae:f1:24:b5:24:88:56:9b:07:3d:91:21:3e:b0:
         41:84:fd:37:97:1f:15:53:cf:8a:48:b3:b9:36:0b:1b:c0:39:
         16:14:64:e4:ab:02:5b:e3:2f:a1:c0:0f:73:8a:e8:4c:16:95:
         e8:9e:50:f7:52:37:b1:03:1d:e8:cd:4d:f0:93:59:1d:c0:61:
         80:8a:48:76:f2:a9:c8:18:cc:15:78:ce:9d:f2:8d:d1:5e:e6:
         f7:78:d1:32:be:7a:ed:a8:7c:b8:9d:d6:6c:65:5a:66:f3:de:
         04:7c:1a:0a:dc:4d:b7:ba:09:39:c1:16:e9:24:6f:bb:4d:ce:
         27:aa:d7:83:c3:0e:35:e1:04:d1:ee:e2:0c:da:d5:16:09:9d:
         f0:40:ff:4f:ea:9b:c9:40:62:dc:88:6f:1c:64:78:81:63:84:
         77:f5:e0:61:e8:be:59:94:39:a5:0e:f4:c1:e7:f7:9a:88:85:
         30:45:f0:ca:96:42:1d:2a:b9:6b:29:c3:5a:e4:9e:db:fc:eb:
         e5:f4:5b:5f:4e:b4:ca:9d:83:c4:17:4c:9f:92:d4:10:57:2a:
         0c:e3:e0:05:c8:58:8c:ab:7d:1b:eb:48:82:ed:db:32:69:36:
         0b:93:92:10
-----BEGIN CERTIFICATE-----
MIIFgDCCBGigAwIBAgICBdEwDQYJKoZIhvcNAQELBQAwRjERMA8GA1UEAxMIQTkx
QjBCQUIxMTAvBgNVBAUTKDgxRjQ2N0FEQzMxN0QxNjM0OEFGNDMzMDRCMDQ0MTQ0
M0ExRkUzMkMwHhcNMjMxMDI0MjA0ODM5WhcNMjQxMjAxMDAwMDAwWjAYMRYwFAYD
VQQDEw02NTM4MmRhNy01NjdmMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAtoUIF64ZAWDlYfD0SjQ9RrBsC+tqFuGMdFJxdynQc2T/QPNHtJriYyoR5G20
FNjs0bnAnyoegJh1e2dC65J3j6huEDgy8SX3ajnV9mgWqffh6+obnJZBIMk0+7AX
A+52YrvaoazrhNcvR0wyeHNnmJIa5a7UR1I7RTug7i0qbM+lwvtA0whBpOc3cFc3
1KFN8Qu0X3gjRIFgdZoATrMsBx0T1UuNQU/LdQuKC0zH6ATaTZ8PWqi7l4NdFjlR
17Xs1M5YG8pHNhfQOaDYbZV67aSeiSG42UyCSwp32NIdYlXuRp+IhtDvEk/U/InQ
QnyEgEUCMf7E3QmXcD+/nGgICQIDAQABo4ICpDCCAqAwHQYDVR0OBBYEFOBNzwJL
gapkltZqMpoiaO6Jty8CMB8GA1UdIwQYMBaAFIH0Z63DF9FjSK9DMEsEQUQ6H+Ms
MA4GA1UdDwEB/wQEAwIHgDCBgwYDVR0fBHwwejB4oHagdIZycnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9tZW1iZXJfcmVwb3NpdG9yeS9BOTFCMEJBQi82MDJDNjY1NDdC
MTUxMUVBQTVBNEE4NjlDNEY5QUUwMi9nZlJucmNNWDBXTklyME13U3dSQlJEb2Y0
eXcuY3JsMH4GCCsGAQUFBwEBBHIwcDBuBggrBgEFBQcwAoZicnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9yZXBvc2l0b3J5L0I1MjdFRjU4MUQ2NjExRTJCQjQ2OEY3Qzcy
RkQxRkYyL2dmUm5yY01YMFdOSXIwTXdTd1JCUkRvZjR5dy5jZXIwSgYDVR0gAQH/
BEAwPjA8BggrBgEFBQcOAjAwMC4GCCsGAQUFBwIBFiJodHRwczovL3d3dy5hcG5p
Yy5uZXQvUlBLSS9DUFMucGRmMIHLBggrBgEFBQcBCwSBvjCBuzCBgwYIKwYBBQUH
MAuGd3JzeW5jOi8vcnBraS5hcG5pYy5uZXQvbWVtYmVyX3JlcG9zaXRvcnkvQTkx
QjBCQUIvNjAyQzY2NTQ3QjE1MTFFQUE1QTRBODY5QzRGOUFFMDIvNTNFNkQzMDQ0
QTg5MTFFQjk0Q0JCQzUwQzRGOUFFMDIucm9hMDMGCCsGAQUFBzANhidodHRwczov
L3JyZHAuYXBuaWMubmV0L25vdGlmaWNhdGlvbi54bWwwLgYIKwYBBQUHAQcBAf8E
HzAdMAwEAgABMAYDBAJngYQwDQQCAAIwBwMFACQDfkAwDQYJKoZIhvcNAQELBQAD
ggEBABnGS7rHXkIBWqEs7vgaeDvd/7ARkV+u8SS1JIhWmwc9kSE+sEGE/TeXHxVT
z4pIs7k2CxvAORYUZOSrAlvjL6HAD3OK6EwWleieUPdSN7EDHejNTfCTWR3AYYCK
SHbyqcgYzBV4zp3yjdFe5vd40TK+eu2ofLid1mxlWmbz3gR8GgrcTbe6CTnBFukk
b7tNzieq14PDDjXhBNHu4gza1RYJnfBA/0/qm8lAYtyIbxxkeIFjhHf14GHovlmU
OaUO9MHn95qIhTBF8MqWQh0quWspw1rkntv86+X0W19OtMqdg8QXTJ+S1BBXKgzj
4AXIWIyrfRvrSILt2zJpNguTkhA=
-----END CERTIFICATE-----