Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/27/14fa9b-a8d1-4781-8deb-9e464499f4fc/1/G8aISUlQ4cirH_s8lo_clVmVBmQ.roa
File:                     G8aISUlQ4cirH_s8lo_clVmVBmQ.roa (raw, json)
Hash identifier:          4EvOxmq0oBROrVGkevmxGaJEhs84CY8l14e6RBTeCWI=
Subject key identifier:   1B:C6:88:49:49:50:E1:C8:AB:1F:FB:3C:96:8F:DC:95:59:95:06:64
Certificate issuer:       /CN=db7153bbb3ea9ed9ceb803e6e7f192aabd9ada34
Certificate serial:       018CC801C901D9A616EF98FD41667679BABC
Authority key identifier: DB:71:53:BB:B3:EA:9E:D9:CE:B8:03:E6:E7:F1:92:AA:BD:9A:DA:34
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/23FTu7PqntnOuAPm5_GSqr2a2jQ.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/27/14fa9b-a8d1-4781-8deb-9e464499f4fc/1/G8aISUlQ4cirH_s8lo_clVmVBmQ.roa
Signing time:             Tue 02 Jan 2024 02:30:09 +0000
ROA not before:           Tue 02 Jan 2024 02:30:09 +0000
ROA not after:            Tue 01 Jul 2025 00:00:00 +0000
asID:                     60449
IP address blocks:        185.1.251.0/24 maxlen: 24
                          2001:7f8:132::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8c:c8:01:c9:01:d9:a6:16:ef:98:fd:41:66:76:79:ba:bc
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=db7153bbb3ea9ed9ceb803e6e7f192aabd9ada34
        Validity
            Not Before: Jan  2 02:30:09 2024 GMT
            Not After : Jul  1 00:00:00 2025 GMT
        Subject: CN=1bc688494950e1c8ab1ffb3c968fdc9559950664
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:82:37:34:4a:56:fd:a2:8b:d1:3f:c0:a8:0e:b3:
                    87:48:59:f1:39:50:8b:f8:5f:fe:1e:97:ff:4c:d0:
                    da:ba:83:7d:35:24:d0:f4:1c:63:b9:32:a9:75:24:
                    ec:34:e4:2b:7d:e8:3a:e7:a8:85:63:fe:ce:bb:15:
                    e1:c3:f9:28:d9:9a:ab:aa:b2:44:e9:39:a4:5e:62:
                    a6:ce:a2:d6:2c:34:13:1a:62:6f:1b:51:d5:ce:57:
                    0f:de:99:97:28:26:e7:c3:6e:f6:a6:aa:12:e3:87:
                    1a:3a:4f:3d:66:f2:cb:e3:cd:1a:3f:a2:83:46:83:
                    71:95:32:c0:93:18:ff:f0:69:92:d6:87:c9:7c:7d:
                    b4:ff:61:1e:bd:35:c1:14:3d:f3:25:df:d6:dc:d0:
                    59:a1:bf:7d:94:a2:01:03:b1:13:98:42:96:9b:92:
                    80:b6:6d:de:69:66:98:66:ab:85:89:fd:bb:9d:0e:
                    74:01:01:33:88:68:76:18:11:b7:a1:7d:ed:57:3a:
                    e6:34:9b:df:87:a5:d2:a8:96:6f:7b:f2:66:d0:c6:
                    9c:59:20:49:c1:4a:f8:e0:9c:ab:e0:76:3f:f9:55:
                    49:78:a7:92:fc:77:f4:3d:3f:4d:e4:4d:7d:72:e2:
                    9a:31:cf:40:c2:59:cb:61:85:cf:9e:41:29:a5:5b:
                    45:4f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                1B:C6:88:49:49:50:E1:C8:AB:1F:FB:3C:96:8F:DC:95:59:95:06:64
            X509v3 Authority Key Identifier:
                keyid:DB:71:53:BB:B3:EA:9E:D9:CE:B8:03:E6:E7:F1:92:AA:BD:9A:DA:34

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/23FTu7PqntnOuAPm5_GSqr2a2jQ.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/27/14fa9b-a8d1-4781-8deb-9e464499f4fc/1/G8aISUlQ4cirH_s8lo_clVmVBmQ.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/27/14fa9b-a8d1-4781-8deb-9e464499f4fc/1/23FTu7PqntnOuAPm5_GSqr2a2jQ.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv4:
                  185.1.251.0/24
                IPv6:
                  2001:7f8:132::/48

    Signature Algorithm: sha256WithRSAEncryption
         8f:fa:f1:88:7c:18:ab:9f:17:a9:81:6f:fe:18:18:d7:14:23:
         e8:63:32:1b:68:11:88:cc:1e:ac:6b:ac:e5:f4:b6:2f:44:d7:
         c6:c4:a0:a5:d0:2e:f9:41:37:35:2b:9d:2e:36:3d:32:48:84:
         54:3e:f9:69:ec:a8:2c:18:ed:b1:a1:98:c8:ee:3e:54:d0:05:
         a6:e7:40:6f:28:1a:94:a9:7a:b2:15:9c:25:8f:b5:79:09:71:
         53:73:4e:2e:c3:0e:d0:33:29:eb:5b:80:de:21:d3:e2:51:b1:
         cc:07:27:de:c2:2d:04:c0:77:c9:10:7b:9e:3a:33:31:30:3f:
         13:10:ad:5f:f5:96:8d:5d:bc:ba:d6:df:8a:9c:74:a7:f2:f6:
         e8:92:72:25:fe:45:c8:49:bb:bf:57:e5:f2:60:9c:71:5d:24:
         c1:bd:18:8e:53:3e:44:6f:7e:a0:e9:43:2a:d7:37:6d:f6:df:
         5b:b1:66:c3:7c:28:56:dd:c4:70:28:8f:7c:03:24:e1:35:0d:
         08:0b:da:17:4d:17:88:c4:6f:42:87:27:59:30:2a:a5:81:a2:
         40:95:48:02:2c:f7:e1:ac:0e:d8:d4:95:b9:b3:da:ce:3e:bc:
         27:b4:24:e4:3e:99:74:fa:27:7e:2d:88:87:a6:d6:35:e5:ac:
         66:03:4b:cd
-----BEGIN CERTIFICATE-----
MIIFDjCCA/agAwIBAgISAYzIAckB2aYW75j9QWZ2ebq8MA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKGRiNzE1M2JiYjNlYTllZDljZWI4MDNlNmU3ZjE5MmFhYmQ5
YWRhMzQwHhcNMjQwMTAyMDIzMDA5WhcNMjUwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
EygxYmM2ODg0OTQ5NTBlMWM4YWIxZmZiM2M5NjhmZGM5NTU5OTUwNjY0MIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgjc0Slb9oovRP8CoDrOHSFnxOVCL
+F/+Hpf/TNDauoN9NSTQ9BxjuTKpdSTsNOQrfeg656iFY/7OuxXhw/ko2ZqrqrJE
6TmkXmKmzqLWLDQTGmJvG1HVzlcP3pmXKCbnw272pqoS44caOk89ZvLL480aP6KD
RoNxlTLAkxj/8GmS1ofJfH20/2EevTXBFD3zJd/W3NBZob99lKIBA7ETmEKWm5KA
tm3eaWaYZquFif27nQ50AQEziGh2GBG3oX3tVzrmNJvfh6XSqJZve/Jm0MacWSBJ
wUr44Jyr4HY/+VVJeKeS/Hf0PT9N5E19cuKaMc9AwlnLYYXPnkEppVtFTwIDAQAB
o4ICGjCCAhYwHQYDVR0OBBYEFBvGiElJUOHIqx/7PJaP3JVZlQZkMB8GA1UdIwQY
MBaAFNtxU7uz6p7ZzrgD5ufxkqq9mto0MA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvMjNGVHU3UHFudG5PdUFQbTVfR1NxcjJhMmpRLmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC8yNy8xNGZhOWItYThkMS00NzgxLThkZWIt
OWU0NjQ0OTlmNGZjLzEvRzhhSVNVbFE0Y2lySF9zOGxvX2NsVm1WQm1RLnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC8yNy8xNGZhOWItYThkMS00NzgxLThkZWItOWU0NjQ0OTlmNGZj
LzEvMjNGVHU3UHFudG5PdUFQbTVfR1NxcjJhMmpRLmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMDAGCCsGAQUFBwEHAQH/BCEwHzAMBAIAATAGAwQAuQH7MA8E
AgACMAkDBwAgAQf4ATIwDQYJKoZIhvcNAQELBQADggEBAI/68Yh8GKufF6mBb/4Y
GNcUI+hjMhtoEYjMHqxrrOX0ti9E18bEoKXQLvlBNzUrnS42PTJIhFQ++WnsqCwY
7bGhmMjuPlTQBabnQG8oGpSperIVnCWPtXkJcVNzTi7DDtAzKetbgN4h0+JRscwH
J97CLQTAd8kQe546MzEwPxMQrV/1lo1dvLrW34qcdKfy9uiSciX+RchJu79X5fJg
nHFdJMG9GI5TPkRvfqDpQyrXN23231uxZsN8KFbdxHAoj3wDJOE1DQgL2hdNF4jE
b0KHJ1kwKqWBokCVSAIs9+GsDtjUlbmz2s4+vCe0JOQ+mXT6J34tiIem1jXlrGYD
S80=
-----END CERTIFICATE-----