Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/01/a1a88f-1dff-4eff-826b-36de657232be/1/ri7y4NBChkQv7rSx5jm88QpPzMk.roa
File:                     ri7y4NBChkQv7rSx5jm88QpPzMk.roa (raw, json)
Hash identifier:          gA+ljmC7PM4qYTAyVV8VE6WUlkkTLgmA62p2Vzg5ADw=
Subject key identifier:   AE:2E:F2:E0:D0:42:86:44:2F:EE:B4:B1:E6:39:BC:F1:0A:4F:CC:C9
Certificate issuer:       /CN=6d20ddd398dac8f62cc12526325f1821fb724f75
Certificate serial:       018CC5003E04FF6ABD44AF03F9CDAB0E91A5
Authority key identifier: 6D:20:DD:D3:98:DA:C8:F6:2C:C1:25:26:32:5F:18:21:FB:72:4F:75
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/bSDd05jayPYswSUmMl8YIftyT3U.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/01/a1a88f-1dff-4eff-826b-36de657232be/1/ri7y4NBChkQv7rSx5jm88QpPzMk.roa
Signing time:             Mon 01 Jan 2024 12:29:36 +0000
ROA not before:           Mon 01 Jan 2024 12:29:36 +0000
ROA not after:            Tue 01 Jul 2025 00:00:00 +0000
asID:                     53356
IP address blocks:        2a09:fb86::/32 maxlen: 32
                          2a10:4705:831a::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8c:c5:00:3e:04:ff:6a:bd:44:af:03:f9:cd:ab:0e:91:a5
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=6d20ddd398dac8f62cc12526325f1821fb724f75
        Validity
            Not Before: Jan  1 12:29:36 2024 GMT
            Not After : Jul  1 00:00:00 2025 GMT
        Subject: CN=ae2ef2e0d04286442feeb4b1e639bcf10a4fccc9
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:81:f3:5a:2e:be:f8:7b:a7:e3:0b:98:91:cd:5b:
                    3a:71:8d:67:ce:1a:49:39:14:0e:b1:51:1c:17:c7:
                    a6:ec:b5:4a:88:91:a3:b4:09:b3:5c:43:00:0f:ab:
                    b8:1a:9c:ae:bb:a6:d9:95:c3:21:0d:26:0e:36:49:
                    97:1c:55:90:03:ea:cd:36:8d:80:b7:63:ff:1f:ba:
                    14:6d:93:d6:12:79:33:45:f7:f4:be:9d:58:37:05:
                    1e:6a:3c:6f:ac:b8:44:37:a7:34:0c:fb:60:91:9e:
                    62:8e:8c:2f:19:da:5c:dc:2d:d1:9f:d7:f6:1f:0e:
                    04:b5:86:5b:08:6b:ac:4e:ec:10:b4:6d:ea:5b:55:
                    22:26:c0:ba:7e:aa:00:5c:c1:51:f2:e0:63:fb:7f:
                    d3:93:7d:1e:de:db:73:80:f9:b1:1b:b0:f2:3f:60:
                    f8:e0:c4:e7:cf:65:5e:e0:b7:f7:c3:44:85:d7:8d:
                    8b:29:70:92:c2:44:bf:87:a1:c2:f3:13:34:2e:c3:
                    b1:38:7f:d7:8a:34:78:78:2c:62:da:d9:ac:a8:66:
                    0c:99:b5:2f:6c:c9:0b:04:f5:d7:fc:8e:ac:3b:65:
                    15:a6:e1:5b:82:1b:db:aa:69:38:f3:5e:22:45:51:
                    3d:69:f2:0f:17:eb:38:ff:b2:d7:dc:2e:dd:cb:19:
                    2f:e3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                AE:2E:F2:E0:D0:42:86:44:2F:EE:B4:B1:E6:39:BC:F1:0A:4F:CC:C9
            X509v3 Authority Key Identifier:
                keyid:6D:20:DD:D3:98:DA:C8:F6:2C:C1:25:26:32:5F:18:21:FB:72:4F:75

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/bSDd05jayPYswSUmMl8YIftyT3U.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/01/a1a88f-1dff-4eff-826b-36de657232be/1/ri7y4NBChkQv7rSx5jm88QpPzMk.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/01/a1a88f-1dff-4eff-826b-36de657232be/1/bSDd05jayPYswSUmMl8YIftyT3U.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv6:
                  2a09:fb86::/32
                  2a10:4705:831a::/48

    Signature Algorithm: sha256WithRSAEncryption
         88:c4:95:eb:3f:87:21:3c:be:aa:44:d3:f0:c0:55:4f:ad:d1:
         17:8a:de:32:1e:0b:3a:52:e9:de:83:80:d4:d3:83:e8:d8:77:
         3c:20:7d:11:be:a0:ba:28:9d:41:a7:3a:49:59:44:85:ee:f2:
         b0:66:46:f7:38:32:3f:19:8d:26:fd:a2:be:6e:64:d9:16:40:
         82:48:77:b6:4a:14:27:6d:f9:5c:e0:70:36:c3:31:4c:61:8b:
         8b:e7:fd:01:db:3a:89:29:73:73:e3:d1:a0:f9:96:4a:bd:89:
         52:1d:d9:3c:df:3e:f5:90:00:fc:52:3c:68:4e:96:f4:36:4a:
         0a:6a:68:ac:aa:5c:78:bd:74:a6:8f:c6:78:86:58:9e:8e:fc:
         a4:a9:03:b5:44:0d:fc:36:b9:72:20:3e:d7:2a:5d:3c:66:18:
         47:82:f8:e0:d9:9b:81:c8:36:92:11:55:67:cd:a1:61:36:ea:
         b4:87:8c:58:18:be:bb:1d:15:0b:f7:69:f2:60:c6:64:5d:e7:
         36:a6:1a:00:6c:1f:7c:b4:a7:c7:53:0f:ef:92:20:f0:38:7e:
         d2:94:4a:05:34:c5:5f:4f:bc:41:21:c9:57:78:ea:a8:bc:d1:
         3d:1d:b5:cd:b9:c0:00:c1:8f:28:4d:4b:de:a2:04:28:62:ff:
         9c:7e:f9:db
-----BEGIN CERTIFICATE-----
MIIFBzCCA++gAwIBAgISAYzFAD4E/2q9RK8D+c2rDpGlMA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKDZkMjBkZGQzOThkYWM4ZjYyY2MxMjUyNjMyNWYxODIxZmI3
MjRmNzUwHhcNMjQwMTAxMTIyOTM2WhcNMjUwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
EyhhZTJlZjJlMGQwNDI4NjQ0MmZlZWI0YjFlNjM5YmNmMTBhNGZjY2M5MIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgfNaLr74e6fjC5iRzVs6cY1nzhpJ
ORQOsVEcF8em7LVKiJGjtAmzXEMAD6u4Gpyuu6bZlcMhDSYONkmXHFWQA+rNNo2A
t2P/H7oUbZPWEnkzRff0vp1YNwUeajxvrLhEN6c0DPtgkZ5ijowvGdpc3C3Rn9f2
Hw4EtYZbCGusTuwQtG3qW1UiJsC6fqoAXMFR8uBj+3/Tk30e3ttzgPmxG7DyP2D4
4MTnz2Ve4Lf3w0SF142LKXCSwkS/h6HC8xM0LsOxOH/XijR4eCxi2tmsqGYMmbUv
bMkLBPXX/I6sO2UVpuFbghvbqmk4814iRVE9afIPF+s4/7LX3C7dyxkv4wIDAQAB
o4ICEzCCAg8wHQYDVR0OBBYEFK4u8uDQQoZEL+60seY5vPEKT8zJMB8GA1UdIwQY
MBaAFG0g3dOY2sj2LMElJjJfGCH7ck91MA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvYlNEZDA1amF5UFlzd1NVbU1sOFlJZnR5VDNVLmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC8wMS9hMWE4OGYtMWRmZi00ZWZmLTgyNmIt
MzZkZTY1NzIzMmJlLzEvcmk3eTROQkNoa1F2N3JTeDVqbTg4UXBQek1rLnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC8wMS9hMWE4OGYtMWRmZi00ZWZmLTgyNmItMzZkZTY1NzIzMmJl
LzEvYlNEZDA1amF5UFlzd1NVbU1sOFlJZnR5VDNVLmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMCkGCCsGAQUFBwEHAQH/BBowGDAWBAIAAjAQAwUAKgn7hgMH
ACoQRwWDGjANBgkqhkiG9w0BAQsFAAOCAQEAiMSV6z+HITy+qkTT8MBVT63RF4re
Mh4LOlLp3oOA1NOD6Nh3PCB9Eb6guiidQac6SVlEhe7ysGZG9zgyPxmNJv2ivm5k
2RZAgkh3tkoUJ235XOBwNsMxTGGLi+f9Ads6iSlzc+PRoPmWSr2JUh3ZPN8+9ZAA
/FI8aE6W9DZKCmporKpceL10po/GeIZYno78pKkDtUQN/Da5ciA+1ypdPGYYR4L4
4Nmbgcg2khFVZ82hYTbqtIeMWBi+ux0VC/dp8mDGZF3nNqYaAGwffLSnx1MP75Ig
8Dh+0pRKBTTFX0+8QSHJV3jqqLzRPR21zbnAAMGPKE1L3qIEKGL/nH752w==
-----END CERTIFICATE-----