Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/18/ba2362-0cc5-49bd-a522-4f0e8ce11a7d/1/QQJknX265vrW35HbhBFho1gu8vY.roa
File:                     QQJknX265vrW35HbhBFho1gu8vY.roa (raw, json)
Hash identifier:          T1pXiVNWQ5PmmEILCorsGW6E+kG42uz0t61ct8iRXzc=
Subject key identifier:   41:02:64:9D:7D:BA:E6:FA:D6:DF:91:DB:84:11:61:A3:58:2E:F2:F6
Certificate issuer:       /CN=d747017564c711bcbd57680a0dfd00f2a5d099db
Certificate serial:       0BFF6A06
Authority key identifier: D7:47:01:75:64:C7:11:BC:BD:57:68:0A:0D:FD:00:F2:A5:D0:99:DB
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/10cBdWTHEby9V2gKDf0A8qXQmds.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/18/ba2362-0cc5-49bd-a522-4f0e8ce11a7d/1/QQJknX265vrW35HbhBFho1gu8vY.roa
Signing time:             Mon 31 Jan 2022 09:43:18 +0000
ROA not before:           Mon 31 Jan 2022 09:43:18 +0000
ROA not after:            Sat 01 Jul 2023 00:00:00 +0000
asID:                     1239
IP address blocks:        195.180.128.0/22 maxlen: 24
                          194.163.192.0/19 maxlen: 24
                          194.163.96.0/19 maxlen: 24
                          62.138.64.0/22 maxlen: 22
                          62.138.72.0/22 maxlen: 22
                          195.180.224.0/20 maxlen: 24
                          194.233.28.0/23 maxlen: 23
                          194.163.64.0/22 maxlen: 22
                          194.163.80.0/22 maxlen: 22
                          195.180.192.0/20 maxlen: 24
                          194.64.144.0/22 maxlen: 22
                          194.64.152.0/22 maxlen: 22
                          194.195.32.0/19 maxlen: 24

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 201288198 (0xbff6a06)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=d747017564c711bcbd57680a0dfd00f2a5d099db
        Validity
            Not Before: Jan 31 09:43:18 2022 GMT
            Not After : Jul  1 00:00:00 2023 GMT
        Subject: CN=4102649d7dbae6fad6df91db841161a3582ef2f6
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ac:4d:2a:af:0f:6a:5a:c5:0b:79:1a:65:8e:30:
                    c7:9b:c0:0c:16:cb:90:d4:7a:21:c6:77:73:78:fd:
                    6f:54:db:3f:59:79:0c:be:58:27:95:d8:7e:49:c4:
                    4e:a6:f3:50:7a:4a:81:45:a6:55:45:3f:8b:f0:3b:
                    48:56:16:5e:84:a3:65:25:d4:5b:d0:c5:6e:68:17:
                    da:d2:bc:90:86:a5:1e:b8:e4:c2:f9:ac:50:61:eb:
                    04:b9:32:3d:50:bb:50:31:66:0a:a1:9d:52:d9:61:
                    40:52:57:15:80:34:32:2a:21:0c:7b:5b:bd:a2:a7:
                    95:d8:33:23:28:e2:70:83:3c:20:b2:8e:4f:73:4b:
                    18:9d:49:49:03:bd:50:45:94:2d:d9:c7:6a:2c:d4:
                    66:e2:2b:2c:04:f3:cb:06:60:1f:b9:5f:6d:95:9a:
                    d9:0f:42:46:49:1e:9c:44:52:6b:3e:1d:e6:39:6c:
                    8b:c9:99:e3:83:20:7b:f6:cb:78:fd:31:7e:a0:31:
                    b1:e9:6a:33:08:15:77:30:af:17:55:b0:b9:ea:67:
                    8b:6b:1f:ab:79:6b:df:7a:53:16:52:d4:ce:21:b4:
                    88:06:19:03:88:e1:a8:c4:17:42:42:a5:da:d2:e2:
                    9d:d3:e4:39:53:81:7b:9a:9f:60:a5:de:c3:83:08:
                    1e:c5
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                41:02:64:9D:7D:BA:E6:FA:D6:DF:91:DB:84:11:61:A3:58:2E:F2:F6
            X509v3 Authority Key Identifier:
                keyid:D7:47:01:75:64:C7:11:BC:BD:57:68:0A:0D:FD:00:F2:A5:D0:99:DB

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/10cBdWTHEby9V2gKDf0A8qXQmds.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/18/ba2362-0cc5-49bd-a522-4f0e8ce11a7d/1/QQJknX265vrW35HbhBFho1gu8vY.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/18/ba2362-0cc5-49bd-a522-4f0e8ce11a7d/1/10cBdWTHEby9V2gKDf0A8qXQmds.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv4:
                  62.138.64.0/22
                  62.138.72.0/22
                  194.64.144.0/22
                  194.64.152.0/22
                  194.163.64.0/22
                  194.163.80.0/22
                  194.163.96.0/19
                  194.163.192.0/19
                  194.195.32.0/19
                  194.233.28.0/23
                  195.180.128.0/22
                  195.180.192.0/20
                  195.180.224.0/20

    Signature Algorithm: sha256WithRSAEncryption
         62:da:7e:9d:54:2d:e6:ce:87:77:63:ad:29:6c:28:4e:ed:5a:
         8b:9f:ab:92:51:1e:5a:06:e8:a6:4a:43:58:49:d2:a9:09:f7:
         3f:99:22:a5:07:e1:f8:3b:fc:ee:b6:72:eb:27:16:13:27:6b:
         fb:22:35:77:8a:ca:b1:bb:e9:e8:25:1f:46:eb:03:70:f3:d1:
         0e:12:a0:23:ba:56:50:7a:3e:98:d3:89:82:03:2f:e5:a7:20:
         99:55:43:4b:df:03:64:5e:2e:09:3e:a0:cb:a1:e4:00:ff:6a:
         82:fa:4d:2f:c0:e1:97:68:ab:53:1c:0b:0e:4f:28:2c:bd:44:
         98:29:e9:6d:04:94:10:dd:cc:03:2a:0e:d1:d4:a4:13:09:29:
         76:59:2f:fc:31:87:20:ab:01:f2:fd:76:67:14:aa:6e:04:c8:
         71:00:d1:6e:09:97:de:a5:9c:bd:b0:c3:a9:08:8b:9c:0c:29:
         df:20:ab:40:93:47:b0:06:10:f8:f1:9e:d1:04:2a:5b:0f:c1:
         7f:17:83:d0:2d:b4:12:73:d4:0e:03:15:84:ff:48:d5:43:d8:
         a5:8e:ca:9e:7f:ea:9e:d2:79:7c:cf:d0:0e:f1:c7:03:a7:31:
         70:71:26:1a:12:36:f5:45:51:af:a2:a9:1e:64:59:e5:63:a2:
         69:ee:c1:4c
-----BEGIN CERTIFICATE-----
MIIFNzCCBB+gAwIBAgIEC/9qBjANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEyhk
NzQ3MDE3NTY0YzcxMWJjYmQ1NzY4MGEwZGZkMDBmMmE1ZDA5OWRiMB4XDTIyMDEz
MTA5NDMxOFoXDTIzMDcwMTAwMDAwMFowMzExMC8GA1UEAxMoNDEwMjY0OWQ3ZGJh
ZTZmYWQ2ZGY5MWRiODQxMTYxYTM1ODJlZjJmNjCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBAKxNKq8PalrFC3kaZY4wx5vADBbLkNR6IcZ3c3j9b1TbP1l5
DL5YJ5XYfknETqbzUHpKgUWmVUU/i/A7SFYWXoSjZSXUW9DFbmgX2tK8kIalHrjk
wvmsUGHrBLkyPVC7UDFmCqGdUtlhQFJXFYA0MiohDHtbvaKnldgzIyjicIM8ILKO
T3NLGJ1JSQO9UEWULdnHaizUZuIrLATzywZgH7lfbZWa2Q9CRkkenERSaz4d5jls
i8mZ44Mge/bLeP0xfqAxselqMwgVdzCvF1Wwuepni2sfq3lr33pTFlLUziG0iAYZ
A4jhqMQXQkKl2tLindPkOVOBe5qfYKXew4MIHsUCAwEAAaOCAlEwggJNMB0GA1Ud
DgQWBBRBAmSdfbrm+tbfkduEEWGjWC7y9jAfBgNVHSMEGDAWgBTXRwF1ZMcRvL1X
aAoN/QDypdCZ2zAOBgNVHQ8BAf8EBAMCB4AwZAYIKwYBBQUHAQEEWDBWMFQGCCsG
AQUFBzAChkhyc3luYzovL3Jwa2kucmlwZS5uZXQvcmVwb3NpdG9yeS9ERUZBVUxU
LzEwY0JkV1RIRWJ5OVYyZ0tEZjBBOHFYUW1kcy5jZXIwgY0GCCsGAQUFBwELBIGA
MH4wfAYIKwYBBQUHMAuGcHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBvc2l0b3J5
L0RFRkFVTFQvMTgvYmEyMzYyLTBjYzUtNDliZC1hNTIyLTRmMGU4Y2UxMWE3ZC8x
L1FRSmtuWDI2NXZyVzM1SGJoQkZobzFndTh2WS5yb2EwgYEGA1UdHwR6MHgwdqB0
oHKGcHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBvc2l0b3J5L0RFRkFVTFQvMTgv
YmEyMzYyLTBjYzUtNDliZC1hNTIyLTRmMGU4Y2UxMWE3ZC8xLzEwY0JkV1RIRWJ5
OVYyZ0tEZjBBOHFYUW1kcy5jcmwwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjBn
BggrBgEFBQcBBwEB/wRYMFYwVAQCAAEwTgMEAj6KQAMEAj6KSAMEAsJAkAMEAsJA
mAMEAsKjQAMEAsKjUAMEBcKjYAMEBcKjwAMEBcLDIAMEAcLpHAMEAsO0gAMEBMO0
wAMEBMO04DANBgkqhkiG9w0BAQsFAAOCAQEAYtp+nVQt5s6Hd2OtKWwoTu1ai5+r
klEeWgbopkpDWEnSqQn3P5kipQfh+Dv87rZy6ycWEydr+yI1d4rKsbvp6CUfRusD
cPPRDhKgI7pWUHo+mNOJggMv5acgmVVDS98DZF4uCT6gy6HkAP9qgvpNL8Dhl2ir
UxwLDk8oLL1EmCnpbQSUEN3MAyoO0dSkEwkpdlkv/DGHIKsB8v12ZxSqbgTIcQDR
bgmX3qWcvbDDqQiLnAwp3yCrQJNHsAYQ+PGe0QQqWw/BfxeD0C20EnPUDgMVhP9I
1UPYpY7Knn/qntJ5fM/QDvHHA6cxcHEmGhI29UVRr6KpHmRZ5WOiae7BTA==
-----END CERTIFICATE-----