Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/30/2c3316-efc7-4952-9efe-8c153965bac9/1/MGUnJ9k8BuO7cneAXveS7uYz-K8.roa
File:                     MGUnJ9k8BuO7cneAXveS7uYz-K8.roa (raw, json)
Hash identifier:          PlLr79Ggg/PRQJcC06zn+2Gfzrcq8VusoUmwxPv/w64=
Subject key identifier:   30:65:27:27:D9:3C:06:E3:BB:72:77:80:5E:F7:92:EE:E6:33:F8:AF
Certificate issuer:       /CN=0d2999042c5e2006bd5aeb7a05de1e96a5e73664
Certificate serial:       D6012A
Authority key identifier: 0D:29:99:04:2C:5E:20:06:BD:5A:EB:7A:05:DE:1E:96:A5:E7:36:64
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/DSmZBCxeIAa9Wut6Bd4elqXnNmQ.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/30/2c3316-efc7-4952-9efe-8c153965bac9/1/MGUnJ9k8BuO7cneAXveS7uYz-K8.roa
Signing time:             Mon 21 Feb 2022 13:49:23 +0000
ROA not before:           Mon 21 Feb 2022 13:49:23 +0000
ROA not after:            Sat 01 Jul 2023 00:00:00 +0000
asID:                     204790
IP address blocks:        2a0e:d780::/29 maxlen: 29
                          2a0e:9bc0::/29 maxlen: 29
                          2a0f:5b80::/29 maxlen: 29
                          2a0e:b3c0::/29 maxlen: 29

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 14025002 (0xd6012a)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=0d2999042c5e2006bd5aeb7a05de1e96a5e73664
        Validity
            Not Before: Feb 21 13:49:23 2022 GMT
            Not After : Jul  1 00:00:00 2023 GMT
        Subject: CN=30652727d93c06e3bb7277805ef792eee633f8af
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:9a:9e:38:fa:17:4a:7d:6b:dd:07:8a:46:51:3a:
                    64:97:41:f0:af:c3:47:ae:96:ee:6c:9f:a7:58:a9:
                    3b:29:ea:28:3a:00:b3:44:9f:d1:9e:25:c3:c0:ec:
                    5b:1a:a8:1e:ef:49:c9:56:48:d2:6a:63:dc:7c:d4:
                    78:f1:7f:5a:89:fe:37:8c:ee:05:10:a7:7b:96:9d:
                    ab:82:82:e5:c5:ce:0b:9b:99:0b:cd:ac:be:ae:6d:
                    c3:0c:ff:a4:95:4a:42:43:d2:51:6f:9c:94:e8:fd:
                    65:d5:a0:56:cc:c6:00:bb:bb:e3:0d:15:9c:4c:2a:
                    45:82:18:b6:4e:a3:5c:0a:54:e8:5a:ae:57:55:d6:
                    36:06:f4:6e:35:8e:14:c1:fc:4a:87:d5:38:8e:9a:
                    c1:5f:d0:39:6d:e5:4f:22:39:4a:b4:03:fc:b0:51:
                    05:e8:0d:ca:8c:3b:92:fb:95:b4:3d:ac:88:1e:5c:
                    b9:35:bd:25:8f:1c:72:6c:6b:e3:bb:68:fd:ac:2d:
                    e6:e8:49:7d:18:1f:03:2b:53:62:4e:c7:6b:b7:a9:
                    fe:32:e1:66:9b:62:07:3a:15:26:fa:72:e7:88:89:
                    bf:30:b7:1c:bd:9b:81:88:f2:11:05:45:ff:c5:cb:
                    81:f4:61:cb:25:2c:df:82:aa:40:b7:c5:e4:3b:dd:
                    be:ed
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                30:65:27:27:D9:3C:06:E3:BB:72:77:80:5E:F7:92:EE:E6:33:F8:AF
            X509v3 Authority Key Identifier:
                keyid:0D:29:99:04:2C:5E:20:06:BD:5A:EB:7A:05:DE:1E:96:A5:E7:36:64

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/DSmZBCxeIAa9Wut6Bd4elqXnNmQ.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/30/2c3316-efc7-4952-9efe-8c153965bac9/1/MGUnJ9k8BuO7cneAXveS7uYz-K8.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/30/2c3316-efc7-4952-9efe-8c153965bac9/1/DSmZBCxeIAa9Wut6Bd4elqXnNmQ.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv6:
                  2a0e:9bc0::/29
                  2a0e:b3c0::/29
                  2a0e:d780::/29
                  2a0f:5b80::/29

    Signature Algorithm: sha256WithRSAEncryption
         25:b9:da:e1:e7:37:49:39:2a:bf:da:a6:86:91:21:cc:dc:f6:
         a9:e3:71:3f:34:8d:e6:23:31:c6:65:a3:18:1c:6c:7e:a2:7d:
         f5:66:ad:c3:ba:3b:97:93:c1:63:1f:1e:5a:cf:f0:d5:6d:3d:
         63:9c:f2:67:f6:7e:c5:d6:23:76:a9:02:61:24:cb:65:fd:5b:
         61:06:6e:32:49:b2:6d:72:72:63:f7:0a:23:cf:32:73:e5:b5:
         17:c5:5c:0a:04:24:9f:2d:86:1a:b9:6d:3d:ca:09:1f:2c:4b:
         5b:80:10:f1:23:14:59:c5:e3:87:09:45:0d:fb:83:00:2e:e3:
         b3:c1:77:cc:56:ed:80:4a:29:cd:7e:d2:5b:37:48:2e:66:6c:
         89:88:43:7d:38:4d:44:4a:06:de:04:1b:0c:78:f2:0f:23:24:
         33:af:de:5b:63:e9:a7:56:70:79:8f:9c:08:7a:b9:71:69:77:
         99:3f:56:09:1a:77:7a:40:9e:bb:0e:5b:59:90:32:a0:5b:6f:
         9e:f0:3a:22:b6:e0:cc:64:d0:36:82:7e:3c:37:17:8a:41:24:
         f4:80:ad:91:02:95:b1:10:aa:a1:e3:25:11:f3:b7:43:e8:e9:
         7d:65:aa:8c:7b:1d:21:06:26:98:e3:03:67:d5:06:66:52:39:
         ba:61:26:83
-----BEGIN CERTIFICATE-----
MIIFBTCCA+2gAwIBAgIEANYBKjANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygw
ZDI5OTkwNDJjNWUyMDA2YmQ1YWViN2EwNWRlMWU5NmE1ZTczNjY0MB4XDTIyMDIy
MTEzNDkyM1oXDTIzMDcwMTAwMDAwMFowMzExMC8GA1UEAxMoMzA2NTI3MjdkOTNj
MDZlM2JiNzI3NzgwNWVmNzkyZWVlNjMzZjhhZjCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBAJqeOPoXSn1r3QeKRlE6ZJdB8K/DR66W7myfp1ipOynqKDoA
s0Sf0Z4lw8DsWxqoHu9JyVZI0mpj3HzUePF/Won+N4zuBRCne5adq4KC5cXOC5uZ
C82svq5twwz/pJVKQkPSUW+clOj9ZdWgVszGALu74w0VnEwqRYIYtk6jXApU6Fqu
V1XWNgb0bjWOFMH8SofVOI6awV/QOW3lTyI5SrQD/LBRBegNyow7kvuVtD2siB5c
uTW9JY8ccmxr47to/awt5uhJfRgfAytTYk7Ha7ep/jLhZptiBzoVJvpy54iJvzC3
HL2bgYjyEQVF/8XLgfRhyyUs34KqQLfF5Dvdvu0CAwEAAaOCAh8wggIbMB0GA1Ud
DgQWBBQwZScn2TwG47tyd4Be95Lu5jP4rzAfBgNVHSMEGDAWgBQNKZkELF4gBr1a
63oF3h6Wpec2ZDAOBgNVHQ8BAf8EBAMCB4AwZAYIKwYBBQUHAQEEWDBWMFQGCCsG
AQUFBzAChkhyc3luYzovL3Jwa2kucmlwZS5uZXQvcmVwb3NpdG9yeS9ERUZBVUxU
L0RTbVpCQ3hlSUFhOVd1dDZCZDRlbHFYbk5tUS5jZXIwgY0GCCsGAQUFBwELBIGA
MH4wfAYIKwYBBQUHMAuGcHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBvc2l0b3J5
L0RFRkFVTFQvMzAvMmMzMzE2LWVmYzctNDk1Mi05ZWZlLThjMTUzOTY1YmFjOS8x
L01HVW5KOWs4QnVPN2NuZUFYdmVTN3VZei1LOC5yb2EwgYEGA1UdHwR6MHgwdqB0
oHKGcHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBvc2l0b3J5L0RFRkFVTFQvMzAv
MmMzMzE2LWVmYzctNDk1Mi05ZWZlLThjMTUzOTY1YmFjOS8xL0RTbVpCQ3hlSUFh
OVd1dDZCZDRlbHFYbk5tUS5jcmwwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjA1
BggrBgEFBQcBBwEB/wQmMCQwIgQCAAIwHAMFAyoOm8ADBQMqDrPAAwUDKg7XgAMF
AyoPW4AwDQYJKoZIhvcNAQELBQADggEBACW52uHnN0k5Kr/apoaRIczc9qnjcT80
jeYjMcZloxgcbH6iffVmrcO6O5eTwWMfHlrP8NVtPWOc8mf2fsXWI3apAmEky2X9
W2EGbjJJsm1ycmP3CiPPMnPltRfFXAoEJJ8thhq5bT3KCR8sS1uAEPEjFFnF44cJ
RQ37gwAu47PBd8xW7YBKKc1+0ls3SC5mbImIQ304TURKBt4EGwx48g8jJDOv3ltj
6adWcHmPnAh6uXFpd5k/Vgkad3pAnrsOW1mQMqBbb57wOiK24Mxk0DaCfjw3F4pB
JPSArZEClbEQqqHjJRHzt0Po6X1lqox7HSEGJpjjA2fVBmZSObphJoM=
-----END CERTIFICATE-----