Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/35/8eb581-9c74-48e1-821a-53180eec56fb/1/Q4kK-cVSiEwVvZUS-oT6d2e_TWg.roa
File:                     Q4kK-cVSiEwVvZUS-oT6d2e_TWg.roa (raw, json)
Hash identifier:          1bAkMEPO91elwWI3Bik/yf+L2tY5tUffC4gUINeyoic=
Subject key identifier:   43:89:0A:F9:C5:52:88:4C:15:BD:95:12:FA:84:FA:77:67:BF:4D:68
Certificate issuer:       /CN=d63343f7cc6c237da3f8b81138c051d8f93c9c4d
Certificate serial:       01856F66DD2433E1BFFB40CB5031B36F0437
Authority key identifier: D6:33:43:F7:CC:6C:23:7D:A3:F8:B8:11:38:C0:51:D8:F9:3C:9C:4D
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/1jND98xsI32j-LgROMBR2Pk8nE0.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/35/8eb581-9c74-48e1-821a-53180eec56fb/1/Q4kK-cVSiEwVvZUS-oT6d2e_TWg.roa
Signing time:             Sun 01 Jan 2023 22:14:50 +0000
ROA not before:           Sun 01 Jan 2023 22:14:50 +0000
ROA not after:            Mon 01 Jul 2024 00:00:00 +0000
asID:                     201824
IP address blocks:        2001:67c:670::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:85:6f:66:dd:24:33:e1:bf:fb:40:cb:50:31:b3:6f:04:37
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=d63343f7cc6c237da3f8b81138c051d8f93c9c4d
        Validity
            Not Before: Jan  1 22:14:50 2023 GMT
            Not After : Jul  1 00:00:00 2024 GMT
        Subject: CN=43890af9c552884c15bd9512fa84fa7767bf4d68
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ac:c1:51:8e:03:d0:9f:ec:12:16:56:d4:a3:a9:
                    2e:b4:56:ae:31:e7:61:56:56:5c:13:00:15:1e:3b:
                    02:91:cb:5a:82:ca:a7:09:d5:c9:c5:2d:22:20:4c:
                    16:4f:9b:40:fe:e2:12:08:2d:f5:82:38:70:85:d6:
                    af:7e:b3:9a:e1:17:c5:26:3c:92:f0:c2:dd:e1:4b:
                    61:6b:be:20:47:f7:9f:68:49:fe:dc:f1:19:2e:b6:
                    63:50:fd:69:bf:8c:0c:3d:73:e2:98:be:a9:61:82:
                    a7:62:28:f3:6c:95:b5:9c:9f:d1:fe:77:fc:c3:c5:
                    68:b9:fb:8b:a5:a5:ba:34:dc:c8:16:bd:19:7a:e0:
                    d0:e5:b1:82:7e:23:09:eb:a8:36:80:ed:fa:84:8f:
                    40:f6:98:2d:87:ab:b9:25:55:2a:73:09:20:ad:1c:
                    68:08:79:24:b5:39:44:9e:11:14:e1:09:97:0d:40:
                    18:59:1a:1c:4c:a4:ed:96:fe:fb:4b:f4:51:fc:8d:
                    a7:c4:06:fb:89:c3:40:1c:8b:1e:81:63:31:10:df:
                    e5:67:ef:fb:14:c6:30:a6:97:44:c5:05:85:a7:d7:
                    4b:64:8e:75:64:2e:e0:db:9f:72:b0:50:4f:25:e3:
                    7a:f4:ba:3e:b0:f9:c4:c1:4a:5d:a9:f0:0a:07:f9:
                    f1:33
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                43:89:0A:F9:C5:52:88:4C:15:BD:95:12:FA:84:FA:77:67:BF:4D:68
            X509v3 Authority Key Identifier:
                keyid:D6:33:43:F7:CC:6C:23:7D:A3:F8:B8:11:38:C0:51:D8:F9:3C:9C:4D

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/1jND98xsI32j-LgROMBR2Pk8nE0.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/35/8eb581-9c74-48e1-821a-53180eec56fb/1/Q4kK-cVSiEwVvZUS-oT6d2e_TWg.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/35/8eb581-9c74-48e1-821a-53180eec56fb/1/1jND98xsI32j-LgROMBR2Pk8nE0.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv6:
                  2001:67c:670::/48

    Signature Algorithm: sha256WithRSAEncryption
         26:74:27:19:79:01:89:f0:8d:6d:59:32:9f:d8:c2:83:6d:bd:
         bd:6f:87:f5:60:07:32:72:8c:f6:5b:1e:79:18:50:41:ac:18:
         ee:af:b8:03:ea:d7:41:cc:6b:0a:74:fa:bb:64:c3:a9:2a:e7:
         60:89:c2:fc:79:d5:ee:8c:9f:4d:5e:1c:34:40:8e:7e:05:dc:
         1e:82:85:6b:29:2e:9f:09:74:a6:f1:9a:11:ef:a7:d6:ab:f5:
         52:d2:51:b3:2f:7a:81:84:14:e3:a3:f1:2a:d7:69:6d:62:12:
         e2:dd:63:74:31:a5:25:a3:38:18:95:04:d7:2a:bc:af:ff:23:
         d3:a3:b0:75:62:7e:be:64:bb:00:5e:5e:2d:37:72:39:c1:a8:
         5c:2a:b3:3a:c1:a7:e1:97:42:a6:e4:4b:bd:f1:9e:71:33:66:
         3c:ff:f0:67:9d:1e:d7:a3:86:d4:39:85:a5:a8:35:6d:89:33:
         ab:8d:6b:b3:b2:63:06:9e:7d:6a:2c:72:b2:8e:20:1b:fe:ec:
         de:dc:21:c8:b0:43:5f:6c:be:81:c2:f1:21:f8:3e:7e:e2:36:
         53:a5:8a:67:10:6a:38:35:ff:a7:60:53:a1:9a:3b:77:d6:75:
         34:dc:7d:e6:c4:b4:22:55:67:d0:97:8e:3f:06:67:c6:c2:d3:
         79:04:01:21
-----BEGIN CERTIFICATE-----
MIIFADCCA+igAwIBAgISAYVvZt0kM+G/+0DLUDGzbwQ3MA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKGQ2MzM0M2Y3Y2M2YzIzN2RhM2Y4YjgxMTM4YzA1MWQ4Zjkz
YzljNGQwHhcNMjMwMTAxMjIxNDUwWhcNMjQwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
Eyg0Mzg5MGFmOWM1NTI4ODRjMTViZDk1MTJmYTg0ZmE3NzY3YmY0ZDY4MIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArMFRjgPQn+wSFlbUo6kutFauMedh
VlZcEwAVHjsCkctagsqnCdXJxS0iIEwWT5tA/uISCC31gjhwhdavfrOa4RfFJjyS
8MLd4Utha74gR/efaEn+3PEZLrZjUP1pv4wMPXPimL6pYYKnYijzbJW1nJ/R/nf8
w8VoufuLpaW6NNzIFr0ZeuDQ5bGCfiMJ66g2gO36hI9A9pgth6u5JVUqcwkgrRxo
CHkktTlEnhEU4QmXDUAYWRocTKTtlv77S/RR/I2nxAb7icNAHIsegWMxEN/lZ+/7
FMYwppdExQWFp9dLZI51ZC7g259ysFBPJeN69Lo+sPnEwUpdqfAKB/nxMwIDAQAB
o4ICDDCCAggwHQYDVR0OBBYEFEOJCvnFUohMFb2VEvqE+ndnv01oMB8GA1UdIwQY
MBaAFNYzQ/fMbCN9o/i4ETjAUdj5PJxNMA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvMWpORDk4eHNJMzJqLUxnUk9NQlIyUGs4bkUwLmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC8zNS84ZWI1ODEtOWM3NC00OGUxLTgyMWEt
NTMxODBlZWM1NmZiLzEvUTRrSy1jVlNpRXdWdlpVUy1vVDZkMmVfVFdnLnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC8zNS84ZWI1ODEtOWM3NC00OGUxLTgyMWEtNTMxODBlZWM1NmZi
LzEvMWpORDk4eHNJMzJqLUxnUk9NQlIyUGs4bkUwLmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMCIGCCsGAQUFBwEHAQH/BBMwETAPBAIAAjAJAwcAIAEGfAZw
MA0GCSqGSIb3DQEBCwUAA4IBAQAmdCcZeQGJ8I1tWTKf2MKDbb29b4f1YAcycoz2
Wx55GFBBrBjur7gD6tdBzGsKdPq7ZMOpKudgicL8edXujJ9NXhw0QI5+BdwegoVr
KS6fCXSm8ZoR76fWq/VS0lGzL3qBhBTjo/Eq12ltYhLi3WN0MaUlozgYlQTXKryv
/yPTo7B1Yn6+ZLsAXl4tN3I5wahcKrM6wafhl0Km5Eu98Z5xM2Y8//BnnR7Xo4bU
OYWlqDVtiTOrjWuzsmMGnn1qLHKyjiAb/uze3CHIsENfbL6BwvEh+D5+4jZTpYpn
EGo4Nf+nYFOhmjt31nU03H3mxLQiVWfQl44/BmfGwtN5BAEh
-----END CERTIFICATE-----