Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/24/4a8b67-cc91-4e96-8060-82bcab16656f/1/DnfhBK4M1xUhRdG9WNgPOx54JRk.roa
File:                     DnfhBK4M1xUhRdG9WNgPOx54JRk.roa (raw, json)
Hash identifier:          46eFCDRmqZkcOOQ2JOVE2W065uNJS6vLdvx/AzfFpHA=
Subject key identifier:   0E:77:E1:04:AE:0C:D7:15:21:45:D1:BD:58:D8:0F:3B:1E:78:25:19
Certificate issuer:       /CN=9e76a07a335fb7a1ded63aacc51338adc8472670
Certificate serial:       018CC500AA0DC7A633F694C0D76B4530C0E3
Authority key identifier: 9E:76:A0:7A:33:5F:B7:A1:DE:D6:3A:AC:C5:13:38:AD:C8:47:26:70
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/nnagejNft6He1jqsxRM4rchHJnA.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/24/4a8b67-cc91-4e96-8060-82bcab16656f/1/DnfhBK4M1xUhRdG9WNgPOx54JRk.roa
Signing time:             Mon 01 Jan 2024 12:30:04 +0000
ROA not before:           Mon 01 Jan 2024 12:30:04 +0000
ROA not after:            Tue 01 Jul 2025 00:00:00 +0000
asID:                     205414
IP address blocks:        2001:67c:2d20::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8c:c5:00:aa:0d:c7:a6:33:f6:94:c0:d7:6b:45:30:c0:e3
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=9e76a07a335fb7a1ded63aacc51338adc8472670
        Validity
            Not Before: Jan  1 12:30:04 2024 GMT
            Not After : Jul  1 00:00:00 2025 GMT
        Subject: CN=0e77e104ae0cd7152145d1bd58d80f3b1e782519
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b5:1c:b3:f9:05:d7:0a:59:96:cb:54:65:d1:e3:
                    d4:bb:23:68:77:6e:b3:d3:30:9a:b2:ee:0c:7e:7f:
                    51:c4:8d:e6:95:bf:5c:36:bd:f8:f7:f4:b0:41:c8:
                    ee:58:0f:c0:56:4c:22:13:ae:40:84:67:6f:32:11:
                    6a:71:3d:3b:44:f6:3f:52:eb:c8:60:29:1c:26:8b:
                    b7:c7:16:94:0d:03:5a:82:da:67:57:6f:8f:9a:71:
                    3b:2a:05:d2:de:96:a0:4b:c0:32:f3:c5:1a:08:e7:
                    22:80:f6:34:5c:07:84:06:d8:01:f5:8c:9e:60:7c:
                    eb:b7:4f:1e:1e:3e:67:0f:06:b3:e1:cd:ff:85:59:
                    72:5c:62:77:dc:ea:61:fe:80:a8:c0:8a:cc:9c:f3:
                    1f:e1:68:65:39:74:07:f8:1b:79:d6:4d:cf:74:60:
                    5f:4e:0d:2d:ce:7e:80:6a:64:d3:7d:04:52:3a:14:
                    66:97:54:2f:62:93:7e:51:41:25:7e:08:a2:4e:55:
                    f4:11:53:3d:58:1e:3f:f5:9c:89:75:ad:cf:ff:44:
                    0e:77:8a:89:2f:2b:36:e6:9f:75:82:b6:6a:bf:87:
                    10:48:1b:17:2b:78:56:c2:ed:62:4e:27:34:44:7d:
                    e0:77:a9:69:91:5d:14:17:96:3c:8f:ad:e4:c0:d4:
                    b1:83
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                0E:77:E1:04:AE:0C:D7:15:21:45:D1:BD:58:D8:0F:3B:1E:78:25:19
            X509v3 Authority Key Identifier:
                keyid:9E:76:A0:7A:33:5F:B7:A1:DE:D6:3A:AC:C5:13:38:AD:C8:47:26:70

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/nnagejNft6He1jqsxRM4rchHJnA.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/24/4a8b67-cc91-4e96-8060-82bcab16656f/1/DnfhBK4M1xUhRdG9WNgPOx54JRk.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/24/4a8b67-cc91-4e96-8060-82bcab16656f/1/nnagejNft6He1jqsxRM4rchHJnA.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv6:
                  2001:67c:2d20::/48

    Signature Algorithm: sha256WithRSAEncryption
         46:10:3d:c7:97:c0:12:75:2c:c8:ea:9c:73:15:e3:9a:94:47:
         3d:20:62:76:4f:df:14:79:00:0d:80:cb:46:ee:54:21:39:7e:
         e4:c9:a0:19:17:94:1a:96:3b:ee:07:66:42:f3:4a:19:8c:f3:
         a6:29:0e:15:c1:22:3d:02:92:74:83:69:c6:b4:6e:14:a0:94:
         02:3c:3a:98:58:57:5e:69:a2:05:53:99:3f:59:e1:34:93:4f:
         9a:4e:da:e9:ef:5a:a3:1c:27:6d:a6:c9:52:8b:43:cc:f0:f1:
         33:ee:cf:8b:ab:ac:84:de:13:81:cd:f1:c5:3c:ff:0b:8f:8f:
         27:6b:0c:78:3f:14:0a:d1:02:a1:bd:1d:c9:69:02:e7:68:3a:
         e3:86:0f:6a:87:b6:9f:6a:a1:63:1a:96:82:e9:87:89:53:49:
         66:74:46:df:14:df:61:e2:4d:09:6a:54:4c:2f:c7:0d:c2:a3:
         28:ba:d3:57:30:08:66:71:76:5b:4e:8f:eb:48:21:32:dd:50:
         e7:80:e5:80:06:83:4f:02:59:98:38:a3:61:dc:03:32:1b:08:
         13:87:e8:11:c6:dd:0e:c8:9b:e8:37:7b:96:01:cc:60:02:a3:
         98:f4:da:c1:c3:33:99:c4:80:89:95:4d:ee:5d:5c:e1:54:f1:
         ec:d3:92:b6
-----BEGIN CERTIFICATE-----
MIIFADCCA+igAwIBAgISAYzFAKoNx6Yz9pTA12tFMMDjMA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKDllNzZhMDdhMzM1ZmI3YTFkZWQ2M2FhY2M1MTMzOGFkYzg0
NzI2NzAwHhcNMjQwMTAxMTIzMDA0WhcNMjUwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
EygwZTc3ZTEwNGFlMGNkNzE1MjE0NWQxYmQ1OGQ4MGYzYjFlNzgyNTE5MIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtRyz+QXXClmWy1Rl0ePUuyNod26z
0zCasu4Mfn9RxI3mlb9cNr349/SwQcjuWA/AVkwiE65AhGdvMhFqcT07RPY/UuvI
YCkcJou3xxaUDQNagtpnV2+PmnE7KgXS3pagS8Ay88UaCOcigPY0XAeEBtgB9Yye
YHzrt08eHj5nDwaz4c3/hVlyXGJ33Oph/oCowIrMnPMf4WhlOXQH+Bt51k3PdGBf
Tg0tzn6AamTTfQRSOhRml1QvYpN+UUElfgiiTlX0EVM9WB4/9ZyJda3P/0QOd4qJ
Lys25p91grZqv4cQSBsXK3hWwu1iTic0RH3gd6lpkV0UF5Y8j63kwNSxgwIDAQAB
o4ICDDCCAggwHQYDVR0OBBYEFA534QSuDNcVIUXRvVjYDzseeCUZMB8GA1UdIwQY
MBaAFJ52oHozX7eh3tY6rMUTOK3IRyZwMA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvbm5hZ2VqTmZ0NkhlMWpxc3hSTTRyY2hISm5BLmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC8yNC80YThiNjctY2M5MS00ZTk2LTgwNjAt
ODJiY2FiMTY2NTZmLzEvRG5maEJLNE0xeFVoUmRHOVdOZ1BPeDU0SlJrLnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC8yNC80YThiNjctY2M5MS00ZTk2LTgwNjAtODJiY2FiMTY2NTZm
LzEvbm5hZ2VqTmZ0NkhlMWpxc3hSTTRyY2hISm5BLmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMCIGCCsGAQUFBwEHAQH/BBMwETAPBAIAAjAJAwcAIAEGfC0g
MA0GCSqGSIb3DQEBCwUAA4IBAQBGED3Hl8ASdSzI6pxzFeOalEc9IGJ2T98UeQAN
gMtG7lQhOX7kyaAZF5QaljvuB2ZC80oZjPOmKQ4VwSI9ApJ0g2nGtG4UoJQCPDqY
WFdeaaIFU5k/WeE0k0+aTtrp71qjHCdtpslSi0PM8PEz7s+Lq6yE3hOBzfHFPP8L
j48nawx4PxQK0QKhvR3JaQLnaDrjhg9qh7afaqFjGpaC6YeJU0lmdEbfFN9h4k0J
alRML8cNwqMoutNXMAhmcXZbTo/rSCEy3VDngOWABoNPAlmYOKNh3AMyGwgTh+gR
xt0OyJvoN3uWAcxgAqOY9NrBwzOZxICJlU3uXVzhVPHs05K2
-----END CERTIFICATE-----