Route Origin Authorization

$ rpki-client -vvf rpki.cnnic.cn/rpki/A9162E3D0000/137/Gj3geaACi2HyyEMGzqxOmTuCQlQ.roa
File:                     Gj3geaACi2HyyEMGzqxOmTuCQlQ.roa (raw, json)
Hash identifier:          0K1hO9rhMvDeZ6WUWKv81C/6oahomfRhGd4Ta2Cn/w4=
Subject key identifier:   1A:3D:E0:79:A0:02:8B:61:F2:C8:43:06:CE:AC:4E:99:3B:82:42:54
Certificate issuer:       /CN=BDEBED8640CBA6593DA9F9A3DD228D38912458EA
Certificate serial:       74A0
Authority key identifier: BD:EB:ED:86:40:CB:A6:59:3D:A9:F9:A3:DD:22:8D:38:91:24:58:EA
Authority info access:    rsync://rpki.cnnic.cn/rpki/A9162E3D0000/vevthkDLplk9qfmj3SKNOJEkWOo.cer
Subject info access:      rsync://rpki.cnnic.cn/rpki/A9162E3D0000/137/Gj3geaACi2HyyEMGzqxOmTuCQlQ.roa
Signing time:             Tue 08 Jul 2025 07:45:03 +0000
ROA not before:           Tue 08 Jul 2025 07:45:03 +0000
ROA not after:            Fri 03 Apr 2026 08:00:09 +0000
asID:                     24426
IP address blocks:        43.239.48.0/22 maxlen: 22
                          43.246.0.0/22 maxlen: 22
                          43.246.4.0/22 maxlen: 22
                          43.246.12.0/22 maxlen: 22
                          43.246.16.0/22 maxlen: 22
                          43.246.20.0/22 maxlen: 22
                          43.246.24.0/22 maxlen: 22
                          43.246.28.0/22 maxlen: 22
                          43.246.32.0/22 maxlen: 22
                          43.246.36.0/22 maxlen: 22
                          43.246.40.0/22 maxlen: 22
                          43.246.44.0/22 maxlen: 22
                          43.246.52.0/22 maxlen: 22
                          43.246.56.0/22 maxlen: 22
                          43.246.60.0/22 maxlen: 22
                          43.246.64.0/22 maxlen: 22
                          43.246.68.0/22 maxlen: 22
                          43.246.72.0/22 maxlen: 22
                          43.246.76.0/22 maxlen: 22
                          43.246.80.0/22 maxlen: 22
                          43.246.84.0/22 maxlen: 22
                          43.246.88.0/22 maxlen: 22
                          43.246.92.0/22 maxlen: 22
                          43.246.96.0/22 maxlen: 22
                          103.35.48.0/22 maxlen: 22
                          103.236.0.0/22 maxlen: 22
                          103.236.4.0/22 maxlen: 22
                          103.236.8.0/22 maxlen: 22
                          103.236.12.0/22 maxlen: 22
                          103.236.16.0/22 maxlen: 22
                          103.236.20.0/22 maxlen: 22
                          103.236.28.0/22 maxlen: 22
                          103.236.32.0/22 maxlen: 22
                          103.236.36.0/22 maxlen: 22
                          103.236.40.0/22 maxlen: 22
                          103.236.44.0/22 maxlen: 22
                          103.236.48.0/22 maxlen: 22
                          103.236.52.0/22 maxlen: 22
                          103.236.56.0/22 maxlen: 22
                          103.236.60.0/22 maxlen: 22
                          103.236.64.0/22 maxlen: 22
                          103.236.68.0/22 maxlen: 22
                          103.236.72.0/22 maxlen: 22
                          103.236.76.0/22 maxlen: 22
                          103.236.80.0/22 maxlen: 22
                          103.236.84.0/22 maxlen: 22
                          103.236.88.0/22 maxlen: 22
                          103.236.92.0/22 maxlen: 22
                          103.236.96.0/22 maxlen: 22
Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 29856 (0x74a0)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=BDEBED8640CBA6593DA9F9A3DD228D38912458EA
        Validity
            Not Before: Jul  8 07:45:03 2025 GMT
            Not After : Apr  3 08:00:09 2026 GMT
        Subject: CN=1A3DE079A0028B61F2C84306CEAC4E993B824254
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:df:e5:b2:5e:97:c7:0c:6e:ed:3c:a2:f8:92:42:
                    a6:42:9a:23:27:06:6d:9b:8d:dd:d2:1b:bd:ba:1a:
                    0a:43:27:b3:e9:da:95:8f:7b:82:09:98:f7:9e:f5:
                    1e:0f:f6:c9:5a:d3:a3:98:7e:a7:39:2c:a3:50:36:
                    9f:24:df:77:1e:ca:af:37:65:8d:60:d4:e2:a3:1b:
                    4c:2c:25:7f:74:dd:c2:ab:d4:c4:5f:57:f9:57:bb:
                    7e:d6:c7:65:fe:88:e8:db:4c:73:c5:88:50:b8:c6:
                    c4:76:b7:92:0e:1e:ed:66:93:0c:65:71:6e:0a:0d:
                    96:c9:07:d1:c7:6d:d8:ce:3e:e3:05:e1:42:36:23:
                    db:13:3e:92:4a:fa:0e:3b:35:1e:6d:84:90:a0:d9:
                    c0:db:66:2f:05:24:05:7a:4d:b9:af:0d:c2:76:b1:
                    c6:d0:a8:a1:21:25:04:83:51:51:98:83:3e:de:94:
                    ce:e9:9a:7b:1d:0b:14:d0:c6:f3:bc:bd:af:eb:0d:
                    14:fe:4e:08:e3:f2:40:15:a8:99:a9:32:12:2f:b6:
                    a1:c8:47:38:14:9b:8a:9b:72:1e:24:44:7f:e2:cd:
                    8e:ec:e6:62:9f:80:77:43:03:fc:32:e1:39:02:57:
                    8d:b6:95:7f:91:0c:13:23:2e:77:a5:e3:e3:29:f1:
                    e5:b3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                1A:3D:E0:79:A0:02:8B:61:F2:C8:43:06:CE:AC:4E:99:3B:82:42:54
            X509v3 Authority Key Identifier:
                keyid:BD:EB:ED:86:40:CB:A6:59:3D:A9:F9:A3:DD:22:8D:38:91:24:58:EA

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.cnnic.cn/rpki/A9162E3D0000/137/vevthkDLplk9qfmj3SKNOJEkWOo.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.cnnic.cn/rpki/A9162E3D0000/vevthkDLplk9qfmj3SKNOJEkWOo.cer

            X509v3 Key Usage: critical
                Digital Signature
            Subject Information Access:
                Signed Object - URI:rsync://rpki.cnnic.cn/rpki/A9162E3D0000/137/Gj3geaACi2HyyEMGzqxOmTuCQlQ.roa
                RPKI Notify - URI:https://rpki.cnnic.cn/rrdp/notify.xml

            sbgp-ipAddrBlock: critical
                IPv4:
                  43.239.48.0/22
                  43.246.0.0/21
                  43.246.12.0-43.246.47.255
                  43.246.52.0-43.246.99.255
                  103.35.48.0/22
                  103.236.0.0-103.236.23.255
                  103.236.28.0-103.236.99.255

    Signature Algorithm: sha256WithRSAEncryption
         40:df:68:9b:81:a1:1f:4e:7a:7d:57:1b:33:83:b1:9e:08:49:
         a7:37:97:19:ad:d3:10:ac:b3:e3:53:3e:a4:a5:e2:fd:57:61:
         ba:2c:15:4f:e8:fe:d8:58:60:07:5c:c2:11:90:20:13:a5:5e:
         ba:d4:f3:c6:60:10:47:b5:35:0f:88:b0:9a:6f:9e:73:b4:d1:
         71:77:d6:73:43:69:b8:56:05:17:c7:87:bb:5b:59:c8:69:62:
         c8:07:8a:a3:35:6d:f1:bb:bf:a2:ae:e0:d3:9b:bc:c8:81:77:
         e6:de:b3:41:4e:19:97:e3:97:ba:c3:91:0d:5d:88:04:5b:12:
         ed:b6:43:0f:a8:aa:c0:a6:7f:5d:9c:26:aa:cd:17:2a:0b:99:
         16:84:c9:d1:37:69:a6:b7:2a:ed:59:2c:c1:1b:ea:e5:68:32:
         48:a2:dc:44:bb:78:1b:e8:1b:7f:ed:fb:cb:18:72:b0:8b:a9:
         ed:09:7e:f7:00:74:5e:33:9e:90:d2:e4:e2:74:f7:35:bb:0a:
         fa:ef:a3:0d:78:46:cd:83:31:44:f9:a3:ab:4a:05:77:b1:08:
         be:91:86:22:4d:a0:fc:ed:53:48:a1:51:61:d5:f3:a8:95:7e:
         b7:6e:06:12:dc:23:ec:8f:05:bb:08:09:a0:3d:26:7d:3d:33:
         5c:fe:aa:a0
-----BEGIN CERTIFICATE-----
MIIFGDCCBACgAwIBAgICdKAwDQYJKoZIhvcNAQELBQAwMzExMC8GA1UEAxMoQkRF
QkVEODY0MENCQTY1OTNEQTlGOUEzREQyMjhEMzg5MTI0NThFQTAeFw0yNTA3MDgw
NzQ1MDNaFw0yNjA0MDMwODAwMDlaMDMxMTAvBgNVBAMTKDFBM0RFMDc5QTAwMjhC
NjFGMkM4NDMwNkNFQUM0RTk5M0I4MjQyNTQwggEiMA0GCSqGSIb3DQEBAQUAA4IB
DwAwggEKAoIBAQDf5bJel8cMbu08oviSQqZCmiMnBm2bjd3SG726GgpDJ7Pp2pWP
e4IJmPee9R4P9sla06OYfqc5LKNQNp8k33ceyq83ZY1g1OKjG0wsJX903cKr1MRf
V/lXu37Wx2X+iOjbTHPFiFC4xsR2t5IOHu1mkwxlcW4KDZbJB9HHbdjOPuMF4UI2
I9sTPpJK+g47NR5thJCg2cDbZi8FJAV6TbmvDcJ2scbQqKEhJQSDUVGYgz7elM7p
mnsdCxTQxvO8va/rDRT+Tgjj8kAVqJmpMhIvtqHIRzgUm4qbch4kRH/izY7s5mKf
gHdDA/wy4TkCV422lX+RDBMjLnel4+Mp8eWzAgMBAAGjggI0MIICMDAdBgNVHQ4E
FgQUGj3geaACi2HyyEMGzqxOmTuCQlQwHwYDVR0jBBgwFoAUvevthkDLplk9qfmj
3SKNOJEkWOowGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjBcBgNVHR8EVTBTMFGg
T6BNhktyc3luYzovL3Jwa2kuY25uaWMuY24vcnBraS9BOTE2MkUzRDAwMDAvMTM3
L3ZldnRoa0RMcGxrOXFmbWozU0tOT0pFa1dPby5jcmwwYwYIKwYBBQUHAQEEVzBV
MFMGCCsGAQUFBzAChkdyc3luYzovL3Jwa2kuY25uaWMuY24vcnBraS9BOTE2MkUz
RDAwMDAvdmV2dGhrRExwbGs5cWZtajNTS05PSkVrV09vLmNlcjAOBgNVHQ8BAf8E
BAMCB4AwgZwGCCsGAQUFBwELBIGPMIGMMFcGCCsGAQUFBzALhktyc3luYzovL3Jw
a2kuY25uaWMuY24vcnBraS9BOTE2MkUzRDAwMDAvMTM3L0dqM2dlYUFDaTJIeXlF
TUd6cXhPbVR1Q1FsUS5yb2EwMQYIKwYBBQUHMA2GJWh0dHBzOi8vcnBraS5jbm5p
Yy5jbi9ycmRwL25vdGlmeS54bWwwYgYIKwYBBQUHAQcBAf8EUzBRME8EAgABMEkD
BAIr7zADBAMr9gAwDAMEAiv2DAMEBCv2IDAMAwQCK/Y0AwQCK/ZgAwQCZyMwMAsD
AwJn7AMEA2fsEDAMAwQCZ+wcAwQCZ+xgMA0GCSqGSIb3DQEBCwUAA4IBAQBA32ib
gaEfTnp9Vxszg7GeCEmnN5cZrdMQrLPjUz6kpeL9V2G6LBVP6P7YWGAHXMIRkCAT
pV661PPGYBBHtTUPiLCab55ztNFxd9ZzQ2m4VgUXx4e7W1nIaWLIB4qjNW3xu7+i
ruDTm7zIgXfm3rNBThmX45e6w5ENXYgEWxLttkMPqKrApn9dnCaqzRcqC5kWhMnR
N2mmtyrtWSzBG+rlaDJIotxEu3gb6Bt/7fvLGHKwi6ntCX73AHReM56Q0uTidPc1
uwr676MNeEbNgzFE+aOrSgV3sQi+kYYiTaD87VNIoVFh1fOolX63bgYS3CPsjwW7
CAmgPSZ9PTNc/qqg
-----END CERTIFICATE-----
Generated at Sun Jul 20 12:48:52 2025 by rpki-client