Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/4b/6444d1-5f00-4e50-8019-1b6f750cf9a2/1/9mFB1piVHxGYBFrPP59HP9kjzzE.roa
File:                     9mFB1piVHxGYBFrPP59HP9kjzzE.roa (raw, json)
Hash identifier:          u0nGZ+4nuxQc3UfTTTTxqfoD13Ql+ra1WZPtl0inVAA=
Subject key identifier:   F6:61:41:D6:98:95:1F:11:98:04:5A:CF:3F:9F:47:3F:D9:23:CF:31
Certificate issuer:       /CN=a865bae25778beed8880c08df2d3f37fc37abc1e
Certificate serial:       018D045ADFCE221C8688E879EBA387DC7736
Authority key identifier: A8:65:BA:E2:57:78:BE:ED:88:80:C0:8D:F2:D3:F3:7F:C3:7A:BC:1E
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/qGW64ld4vu2IgMCN8tPzf8N6vB4.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/4b/6444d1-5f00-4e50-8019-1b6f750cf9a2/1/9mFB1piVHxGYBFrPP59HP9kjzzE.roa
Signing time:             Sat 13 Jan 2024 19:44:40 +0000
ROA not before:           Sat 13 Jan 2024 19:44:40 +0000
ROA not after:            Tue 01 Jul 2025 00:00:00 +0000
asID:                     49223
IP address blocks:        212.79.112.0/22 maxlen: 22
                          141.105.140.0/22 maxlen: 22
                          212.79.116.0/22 maxlen: 22
                          212.79.120.0/23 maxlen: 23
                          212.87.160.0/21 maxlen: 21
                          212.87.172.0/22 maxlen: 22
                          212.87.176.0/22 maxlen: 22
                          212.87.184.0/22 maxlen: 22
                          212.87.182.0/23 maxlen: 23
                          212.87.188.0/22 maxlen: 22

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8d:04:5a:df:ce:22:1c:86:88:e8:79:eb:a3:87:dc:77:36
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=a865bae25778beed8880c08df2d3f37fc37abc1e
        Validity
            Not Before: Jan 13 19:44:40 2024 GMT
            Not After : Jul  1 00:00:00 2025 GMT
        Subject: CN=f66141d698951f1198045acf3f9f473fd923cf31
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b3:bd:b3:c6:23:25:e5:44:ea:b7:c2:b0:be:84:
                    5e:d6:ec:18:43:dc:c7:6d:c9:a5:5a:01:49:fa:cf:
                    d5:35:e2:fd:23:a6:b9:e1:9f:00:fa:7b:7e:3e:15:
                    90:7b:24:7e:08:50:f2:d9:a2:ad:5f:0c:f1:9d:58:
                    29:14:35:1c:ad:3b:1e:09:f8:73:17:c5:f5:ee:7e:
                    bb:50:0c:4a:66:04:29:45:70:60:45:fd:a7:71:c2:
                    89:ca:96:83:af:24:a5:34:37:7f:1a:59:c3:f3:cd:
                    47:58:97:a5:5e:12:c7:bb:8d:d6:c8:03:3d:02:12:
                    7f:57:c1:97:60:fc:65:c2:ef:e4:a5:31:1e:e0:10:
                    90:6d:da:d7:e3:41:73:d3:8d:15:1b:6d:9d:2e:2a:
                    ed:db:d9:e7:87:3b:2e:77:a2:26:ec:5e:2d:f1:6e:
                    4d:e1:6d:e2:62:54:77:72:61:f0:30:75:23:90:0d:
                    3f:6c:15:2d:0c:1d:fe:14:ef:63:74:73:9d:ef:53:
                    35:a4:6f:a6:94:2c:96:99:f0:b1:e8:9f:d8:4a:ef:
                    be:81:2e:d4:77:51:92:a6:fa:b9:07:bf:c5:99:71:
                    80:67:dd:24:e1:2c:ce:fc:4b:e5:e2:f6:a0:84:1f:
                    d7:43:15:96:a1:03:b3:cd:3d:cd:5f:bc:a0:2c:a0:
                    5c:19
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                F6:61:41:D6:98:95:1F:11:98:04:5A:CF:3F:9F:47:3F:D9:23:CF:31
            X509v3 Authority Key Identifier:
                keyid:A8:65:BA:E2:57:78:BE:ED:88:80:C0:8D:F2:D3:F3:7F:C3:7A:BC:1E

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/qGW64ld4vu2IgMCN8tPzf8N6vB4.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/4b/6444d1-5f00-4e50-8019-1b6f750cf9a2/1/9mFB1piVHxGYBFrPP59HP9kjzzE.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/4b/6444d1-5f00-4e50-8019-1b6f750cf9a2/1/qGW64ld4vu2IgMCN8tPzf8N6vB4.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv4:
                  141.105.140.0/22
                  212.79.112.0-212.79.121.255
                  212.87.160.0/21
                  212.87.172.0-212.87.179.255
                  212.87.182.0-212.87.191.255

    Signature Algorithm: sha256WithRSAEncryption
         6d:39:c7:f5:78:f0:e5:17:a9:79:c3:0e:8a:bc:a4:3a:af:86:
         7d:77:75:a2:c1:f5:6b:21:29:74:e5:29:04:a8:d3:6b:9f:8c:
         b0:93:a6:4a:91:33:29:00:61:6c:05:cd:12:28:c8:72:dc:2a:
         89:96:e4:0c:99:da:7b:3e:3a:f9:fa:be:0b:33:ed:4a:ac:91:
         a9:80:ce:cc:51:61:57:b1:8d:16:08:76:56:ee:12:fd:da:33:
         dc:1b:e3:d0:e4:00:9f:74:41:61:08:4c:4d:65:5e:dd:f1:16:
         c2:dd:ed:6c:b8:5b:ab:79:fc:cb:59:f0:a0:86:9e:16:ce:97:
         97:5f:6d:8f:53:95:47:f1:c5:6a:3e:be:a0:49:3e:23:32:6f:
         2e:c8:e0:87:0a:50:b3:d8:85:92:57:1f:5f:7d:b6:85:e3:16:
         45:46:d2:e3:aa:5b:75:7b:56:13:84:a5:45:fc:50:a3:71:80:
         36:cd:e8:8d:7f:78:8e:02:a1:99:32:e3:4e:4b:cb:e5:a8:98:
         d8:1e:86:93:dc:9e:e4:93:1d:8c:9f:24:31:2c:ed:63:09:df:
         d0:01:da:f1:23:d2:18:8d:83:ac:c5:bd:65:4c:ad:0f:31:e0:
         19:0b:06:51:75:0d:96:7e:26:5e:63:55:37:da:3e:b5:7f:ee:
         4a:c1:08:13
-----BEGIN CERTIFICATE-----
MIIFLTCCBBWgAwIBAgISAY0EWt/OIhyGiOh566OH3Hc2MA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKGE4NjViYWUyNTc3OGJlZWQ4ODgwYzA4ZGYyZDNmMzdmYzM3
YWJjMWUwHhcNMjQwMTEzMTk0NDQwWhcNMjUwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
EyhmNjYxNDFkNjk4OTUxZjExOTgwNDVhY2YzZjlmNDczZmQ5MjNjZjMxMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs72zxiMl5UTqt8KwvoRe1uwYQ9zH
bcmlWgFJ+s/VNeL9I6a54Z8A+nt+PhWQeyR+CFDy2aKtXwzxnVgpFDUcrTseCfhz
F8X17n67UAxKZgQpRXBgRf2nccKJypaDrySlNDd/GlnD881HWJelXhLHu43WyAM9
AhJ/V8GXYPxlwu/kpTEe4BCQbdrX40Fz040VG22dLirt29nnhzsud6Im7F4t8W5N
4W3iYlR3cmHwMHUjkA0/bBUtDB3+FO9jdHOd71M1pG+mlCyWmfCx6J/YSu++gS7U
d1GSpvq5B7/FmXGAZ90k4SzO/Evl4vaghB/XQxWWoQOzzT3NX7ygLKBcGQIDAQAB
o4ICOTCCAjUwHQYDVR0OBBYEFPZhQdaYlR8RmARazz+fRz/ZI88xMB8GA1UdIwQY
MBaAFKhluuJXeL7tiIDAjfLT83/DerweMA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvcUdXNjRsZDR2dTJJZ01DTjh0UHpmOE42dkI0LmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC80Yi82NDQ0ZDEtNWYwMC00ZTUwLTgwMTkt
MWI2Zjc1MGNmOWEyLzEvOW1GQjFwaVZIeEdZQkZyUFA1OUhQOWtqenpFLnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC80Yi82NDQ0ZDEtNWYwMC00ZTUwLTgwMTktMWI2Zjc1MGNmOWEy
LzEvcUdXNjRsZDR2dTJJZ01DTjh0UHpmOE42dkI0LmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CME8GCCsGAQUFBwEHAQH/BEAwPjA8BAIAATA2AwQCjWmMMAwD
BATUT3ADBAHUT3gDBAPUV6AwDAMEAtRXrAMEAtRXsDAMAwQB1Fe2AwQG1FeAMA0G
CSqGSIb3DQEBCwUAA4IBAQBtOcf1ePDlF6l5ww6KvKQ6r4Z9d3WiwfVrISl05SkE
qNNrn4ywk6ZKkTMpAGFsBc0SKMhy3CqJluQMmdp7Pjr5+r4LM+1KrJGpgM7MUWFX
sY0WCHZW7hL92jPcG+PQ5ACfdEFhCExNZV7d8RbC3e1suFurefzLWfCghp4WzpeX
X22PU5VH8cVqPr6gST4jMm8uyOCHClCz2IWSVx9ffbaF4xZFRtLjqlt1e1YThKVF
/FCjcYA2zeiNf3iOAqGZMuNOS8vlqJjYHoaT3J7kkx2MnyQxLO1jCd/QAdrxI9IY
jYOsxb1lTK0PMeAZCwZRdQ2WfiZeY1U32j61f+5KwQgT
-----END CERTIFICATE-----