Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/16/2e9456-37c3-4274-bc31-64ee464b6404/1/mrLX6XEwvcLZn8-HKJSOZrXG9cM.roa
File:                     mrLX6XEwvcLZn8-HKJSOZrXG9cM.roa (raw, json)
Hash identifier:          gGWDxkLq5/8WAw4dmySXwPpcigTvTLr0S9urMk65W1U=
Subject key identifier:   9A:B2:D7:E9:71:30:BD:C2:D9:9F:CF:87:28:94:8E:66:B5:C6:F5:C3
Certificate issuer:       /CN=3b1f8da9cb0e362c424196b20e604e94a83bc850
Certificate serial:       01857130A1CBD4B34F88DF1CD25E6CF176B1
Authority key identifier: 3B:1F:8D:A9:CB:0E:36:2C:42:41:96:B2:0E:60:4E:94:A8:3B:C8:50
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/Ox-NqcsONixCQZayDmBOlKg7yFA.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/16/2e9456-37c3-4274-bc31-64ee464b6404/1/mrLX6XEwvcLZn8-HKJSOZrXG9cM.roa
Signing time:             Mon 02 Jan 2023 06:34:50 +0000
ROA not before:           Mon 02 Jan 2023 06:34:50 +0000
ROA not after:            Mon 01 Jul 2024 00:00:00 +0000
asID:                     204790
IP address blocks:        2a11:b980::/29 maxlen: 29

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:85:71:30:a1:cb:d4:b3:4f:88:df:1c:d2:5e:6c:f1:76:b1
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=3b1f8da9cb0e362c424196b20e604e94a83bc850
        Validity
            Not Before: Jan  2 06:34:50 2023 GMT
            Not After : Jul  1 00:00:00 2024 GMT
        Subject: CN=9ab2d7e97130bdc2d99fcf8728948e66b5c6f5c3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:e1:af:4b:ee:8c:2c:e1:91:1e:b4:f9:bd:74:26:
                    da:fa:a5:9e:11:c2:12:12:69:1c:c5:7e:bf:c5:f6:
                    ae:6f:92:87:71:24:74:c9:89:70:12:ec:c6:ca:1a:
                    80:8a:d0:30:49:fa:82:fb:c1:38:3f:df:3d:0b:12:
                    8c:13:3c:6d:d6:e4:74:f9:41:8f:7d:97:4f:ea:0b:
                    8f:3c:ef:5f:f6:f8:3e:37:51:3d:35:d9:be:5a:45:
                    46:7e:6b:f9:82:38:0a:ec:d6:2b:36:05:f4:b6:45:
                    99:d7:ac:d6:3a:74:ba:22:35:c0:9f:c2:5e:f1:76:
                    df:9b:e0:5a:3e:87:55:07:fe:b0:73:9d:3d:91:e1:
                    47:2a:5d:57:9e:5f:f0:85:88:5e:ac:24:52:c4:de:
                    d8:cf:7f:f7:56:12:7a:cd:7e:3a:a7:4a:cd:6c:45:
                    93:24:56:15:30:39:5f:3e:78:ac:5b:98:b2:50:2f:
                    21:c0:da:3c:5b:7c:0e:43:a9:3f:ae:3a:96:f9:7c:
                    ad:98:43:45:f5:7b:10:a9:7f:1c:06:30:46:12:58:
                    63:2f:ca:16:b6:60:4f:ac:13:cd:9f:3c:17:e2:c6:
                    9d:86:d6:c8:ec:01:8d:fd:9c:a5:5b:5a:50:c0:3b:
                    99:78:45:9e:ae:f8:23:4b:90:6b:e5:ee:e5:91:70:
                    a8:51
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                9A:B2:D7:E9:71:30:BD:C2:D9:9F:CF:87:28:94:8E:66:B5:C6:F5:C3
            X509v3 Authority Key Identifier:
                keyid:3B:1F:8D:A9:CB:0E:36:2C:42:41:96:B2:0E:60:4E:94:A8:3B:C8:50

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/Ox-NqcsONixCQZayDmBOlKg7yFA.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/16/2e9456-37c3-4274-bc31-64ee464b6404/1/mrLX6XEwvcLZn8-HKJSOZrXG9cM.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/16/2e9456-37c3-4274-bc31-64ee464b6404/1/Ox-NqcsONixCQZayDmBOlKg7yFA.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv6:
                  2a11:b980::/29

    Signature Algorithm: sha256WithRSAEncryption
         73:f7:55:ff:16:79:76:d5:9c:02:84:a9:3a:74:fa:da:8c:69:
         68:e7:fe:b0:df:16:da:13:f6:55:f0:b9:72:12:ea:1a:4c:27:
         32:43:b1:7e:ac:78:f5:46:2a:94:6e:05:c3:db:34:21:56:a0:
         46:73:cd:cd:93:82:bd:1d:aa:ec:de:8a:6d:14:f4:f0:36:21:
         80:23:eb:13:3a:93:29:d8:5e:79:b3:c0:2b:36:98:ce:d8:43:
         cb:ad:67:80:ca:2c:69:cb:d2:a8:2a:fe:ff:56:61:18:b0:a2:
         b5:94:a7:8f:af:73:9f:4a:5f:96:26:43:ab:0b:95:31:7f:8a:
         85:17:6e:d0:8b:7c:5f:c9:f5:2b:34:98:e5:c8:e5:2a:5b:06:
         8e:43:6a:3c:a9:4f:ea:4a:0a:f2:3d:c5:3c:b0:45:bd:2a:04:
         b9:6a:98:93:9b:0f:3d:16:b8:0d:4c:9a:d2:18:73:de:46:92:
         b0:36:70:ee:21:12:c8:77:74:3c:68:aa:13:42:c7:60:f0:0b:
         f2:6e:95:56:3f:4c:55:1d:c3:2d:30:fb:df:f3:8d:0d:2e:c2:
         8f:bf:b7:29:77:16:92:a5:4e:b2:d9:10:48:7b:4d:dd:85:7c:
         4e:d9:f9:59:be:ed:38:c8:5d:c6:35:65:e3:64:d7:3e:d7:27:
         8b:de:f7:83
-----BEGIN CERTIFICATE-----
MIIE/jCCA+agAwIBAgISAYVxMKHL1LNPiN8c0l5s8XaxMA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKDNiMWY4ZGE5Y2IwZTM2MmM0MjQxOTZiMjBlNjA0ZTk0YTgz
YmM4NTAwHhcNMjMwMTAyMDYzNDUwWhcNMjQwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
Eyg5YWIyZDdlOTcxMzBiZGMyZDk5ZmNmODcyODk0OGU2NmI1YzZmNWMzMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4a9L7ows4ZEetPm9dCba+qWeEcIS
EmkcxX6/xfaub5KHcSR0yYlwEuzGyhqAitAwSfqC+8E4P989CxKMEzxt1uR0+UGP
fZdP6guPPO9f9vg+N1E9Ndm+WkVGfmv5gjgK7NYrNgX0tkWZ16zWOnS6IjXAn8Je
8Xbfm+BaPodVB/6wc509keFHKl1Xnl/whYherCRSxN7Yz3/3VhJ6zX46p0rNbEWT
JFYVMDlfPnisW5iyUC8hwNo8W3wOQ6k/rjqW+XytmENF9XsQqX8cBjBGElhjL8oW
tmBPrBPNnzwX4sadhtbI7AGN/ZylW1pQwDuZeEWervgjS5Br5e7lkXCoUQIDAQAB
o4ICCjCCAgYwHQYDVR0OBBYEFJqy1+lxML3C2Z/PhyiUjma1xvXDMB8GA1UdIwQY
MBaAFDsfjanLDjYsQkGWsg5gTpSoO8hQMA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvT3gtTnFjc09OaXhDUVpheURtQk9sS2c3eUZBLmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC8xNi8yZTk0NTYtMzdjMy00Mjc0LWJjMzEt
NjRlZTQ2NGI2NDA0LzEvbXJMWDZYRXd2Y0xabjgtSEtKU09aclhHOWNNLnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC8xNi8yZTk0NTYtMzdjMy00Mjc0LWJjMzEtNjRlZTQ2NGI2NDA0
LzEvT3gtTnFjc09OaXhDUVpheURtQk9sS2c3eUZBLmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMCAGCCsGAQUFBwEHAQH/BBEwDzANBAIAAjAHAwUDKhG5gDAN
BgkqhkiG9w0BAQsFAAOCAQEAc/dV/xZ5dtWcAoSpOnT62oxpaOf+sN8W2hP2VfC5
chLqGkwnMkOxfqx49UYqlG4Fw9s0IVagRnPNzZOCvR2q7N6KbRT08DYhgCPrEzqT
KdheebPAKzaYzthDy61ngMosacvSqCr+/1ZhGLCitZSnj69zn0pfliZDqwuVMX+K
hRdu0It8X8n1KzSY5cjlKlsGjkNqPKlP6koK8j3FPLBFvSoEuWqYk5sPPRa4DUya
0hhz3kaSsDZw7iESyHd0PGiqE0LHYPAL8m6VVj9MVR3DLTD73/ONDS7Cj7+3KXcW
kqVOstkQSHtN3YV8Ttn5Wb7tOMhdxjVl42TXPtcni973gw==
-----END CERTIFICATE-----