Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/70/405bbd-5913-4e95-8e75-fe0659176a56/1/_ZXjrmlLfWHRwYQ-9g04hr-fQVk.roa
File:                     _ZXjrmlLfWHRwYQ-9g04hr-fQVk.roa (raw, json)
Hash identifier:          F6RNW1eK5lBpgJKO+eaGgwPyigGrrl08aOFNeOtyjbU=
Subject key identifier:   FD:95:E3:AE:69:4B:7D:61:D1:C1:84:3E:F6:0D:38:86:BF:9F:41:59
Certificate issuer:       /CN=2ac3daa1b14850f2e61c592b2191915a5e65a478
Certificate serial:       13E22FEA
Authority key identifier: 2A:C3:DA:A1:B1:48:50:F2:E6:1C:59:2B:21:91:91:5A:5E:65:A4:78
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/KsPaobFIUPLmHFkrIZGRWl5lpHg.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/70/405bbd-5913-4e95-8e75-fe0659176a56/1/_ZXjrmlLfWHRwYQ-9g04hr-fQVk.roa
Signing time:             Mon 21 Feb 2022 07:49:57 +0000
ROA not before:           Mon 21 Feb 2022 07:49:57 +0000
ROA not after:            Sat 01 Jul 2023 00:00:00 +0000
asID:                     61317
IP address blocks:        85.8.164.0/22 maxlen: 24
                          212.90.100.0/22 maxlen: 24
                          185.248.184.0/22 maxlen: 24
                          185.220.236.0/22 maxlen: 24
                          188.253.0.0/23 maxlen: 24
                          91.132.59.0/24 maxlen: 24
                          193.36.73.0/24 maxlen: 24
                          193.36.85.0/24 maxlen: 24
                          193.36.84.0/24 maxlen: 24
                          212.87.192.0/22 maxlen: 24
                          185.234.144.0/22 maxlen: 24
                          185.59.115.0/24 maxlen: 24
                          82.115.20.0/23 maxlen: 24
                          82.115.24.0/22 maxlen: 24
                          185.129.108.0/23 maxlen: 24

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 333590506 (0x13e22fea)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=2ac3daa1b14850f2e61c592b2191915a5e65a478
        Validity
            Not Before: Feb 21 07:49:57 2022 GMT
            Not After : Jul  1 00:00:00 2023 GMT
        Subject: CN=fd95e3ae694b7d61d1c1843ef60d3886bf9f4159
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:bb:b3:0b:1f:e3:14:28:eb:c8:49:0f:d3:ed:d9:
                    b4:8e:eb:bb:0b:7f:88:b7:5f:75:25:dd:ba:05:de:
                    48:4c:3b:7e:5c:b1:77:c1:23:03:ec:c8:34:91:b7:
                    30:52:6b:a7:0a:1c:8d:7a:42:12:07:e7:54:18:65:
                    38:8c:dc:45:97:c1:14:b3:24:87:c8:4d:c6:f2:15:
                    6e:ce:59:78:9d:8f:0a:8c:5c:e2:f8:de:54:0f:09:
                    db:2d:39:57:02:08:dd:a4:4d:2f:4d:44:78:27:0b:
                    57:3c:f5:6a:0c:5f:fa:ac:c0:8d:20:53:ad:69:dd:
                    a5:85:96:a1:c4:f3:18:d4:a4:47:9a:5d:e2:1d:43:
                    fe:72:c9:11:69:f2:e8:b5:b6:60:c6:9a:48:42:88:
                    8d:12:2e:8b:d2:31:78:b5:b6:63:44:88:18:85:34:
                    25:4a:66:a5:ae:f3:90:e5:a7:92:8e:5f:68:49:80:
                    2b:84:c7:a4:05:af:37:e7:5f:a5:94:0d:91:2c:37:
                    ee:bd:7c:3a:df:85:f9:6a:de:6f:9c:74:76:a7:1f:
                    d9:28:61:f1:2c:6b:96:ca:d8:8b:48:ec:b0:9d:1f:
                    ac:d0:f5:b7:07:27:d6:75:f9:0b:47:f2:2e:17:29:
                    15:d3:99:37:73:4e:ff:c1:d3:d0:54:49:b8:3f:69:
                    1d:8f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                FD:95:E3:AE:69:4B:7D:61:D1:C1:84:3E:F6:0D:38:86:BF:9F:41:59
            X509v3 Authority Key Identifier:
                keyid:2A:C3:DA:A1:B1:48:50:F2:E6:1C:59:2B:21:91:91:5A:5E:65:A4:78

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/KsPaobFIUPLmHFkrIZGRWl5lpHg.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/70/405bbd-5913-4e95-8e75-fe0659176a56/1/_ZXjrmlLfWHRwYQ-9g04hr-fQVk.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/70/405bbd-5913-4e95-8e75-fe0659176a56/1/KsPaobFIUPLmHFkrIZGRWl5lpHg.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv4:
                  82.115.20.0/23
                  82.115.24.0/22
                  85.8.164.0/22
                  91.132.59.0/24
                  185.59.115.0/24
                  185.129.108.0/23
                  185.220.236.0/22
                  185.234.144.0/22
                  185.248.184.0/22
                  188.253.0.0/23
                  193.36.73.0/24
                  193.36.84.0/23
                  212.87.192.0/22
                  212.90.100.0/22

    Signature Algorithm: sha256WithRSAEncryption
         82:12:fd:a8:fb:93:54:50:8b:85:6c:1a:de:18:2a:2c:ee:43:
         bb:6d:51:01:e5:ea:33:7f:60:4e:a9:a7:51:3e:79:00:a1:ef:
         fe:2a:aa:c1:53:c9:6e:96:c1:21:39:2a:d6:32:9d:a1:db:cc:
         a1:90:4c:af:96:c6:2d:24:4f:ce:d2:45:e4:e0:13:5e:5e:08:
         82:18:bc:4f:a5:e2:a2:28:72:6c:1a:77:86:67:ec:f6:d5:dc:
         63:6e:dc:69:0e:1b:89:f5:32:8d:be:0b:61:a3:96:f2:4a:9e:
         cb:b4:0c:79:20:b8:d2:c8:24:f8:a1:da:4a:ae:11:71:76:9b:
         81:44:6a:50:25:d9:99:fd:0d:f2:82:82:7a:19:03:cb:af:49:
         50:8d:c6:aa:3b:b2:3b:92:88:51:b5:bc:da:71:78:6e:26:38:
         0b:ff:84:0c:56:1f:17:21:26:9e:f4:d5:8e:11:54:ce:80:cf:
         4d:6a:41:01:c0:54:45:40:27:f1:b3:69:02:36:c7:61:b8:15:
         24:69:04:b5:fe:82:22:d8:03:cc:9c:54:03:30:4c:57:16:7c:
         1d:31:a0:3d:f7:fa:91:f0:f9:d4:de:00:1d:bc:fe:5c:a9:48:
         d6:ae:fa:6d:8f:dc:1a:94:57:9f:01:fa:a0:e2:8c:75:c7:d5:
         99:59:fb:3e
-----BEGIN CERTIFICATE-----
MIIFPTCCBCWgAwIBAgIEE+Iv6jANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygy
YWMzZGFhMWIxNDg1MGYyZTYxYzU5MmIyMTkxOTE1YTVlNjVhNDc4MB4XDTIyMDIy
MTA3NDk1N1oXDTIzMDcwMTAwMDAwMFowMzExMC8GA1UEAxMoZmQ5NWUzYWU2OTRi
N2Q2MWQxYzE4NDNlZjYwZDM4ODZiZjlmNDE1OTCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBALuzCx/jFCjryEkP0+3ZtI7ruwt/iLdfdSXdugXeSEw7flyx
d8EjA+zINJG3MFJrpwocjXpCEgfnVBhlOIzcRZfBFLMkh8hNxvIVbs5ZeJ2PCoxc
4vjeVA8J2y05VwII3aRNL01EeCcLVzz1agxf+qzAjSBTrWndpYWWocTzGNSkR5pd
4h1D/nLJEWny6LW2YMaaSEKIjRIui9IxeLW2Y0SIGIU0JUpmpa7zkOWnko5faEmA
K4THpAWvN+dfpZQNkSw37r18Ot+F+Wreb5x0dqcf2Shh8SxrlsrYi0jssJ0frND1
twcn1nX5C0fyLhcpFdOZN3NO/8HT0FRJuD9pHY8CAwEAAaOCAlcwggJTMB0GA1Ud
DgQWBBT9leOuaUt9YdHBhD72DTiGv59BWTAfBgNVHSMEGDAWgBQqw9qhsUhQ8uYc
WSshkZFaXmWkeDAOBgNVHQ8BAf8EBAMCB4AwZAYIKwYBBQUHAQEEWDBWMFQGCCsG
AQUFBzAChkhyc3luYzovL3Jwa2kucmlwZS5uZXQvcmVwb3NpdG9yeS9ERUZBVUxU
L0tzUGFvYkZJVVBMbUhGa3JJWkdSV2w1bHBIZy5jZXIwgY0GCCsGAQUFBwELBIGA
MH4wfAYIKwYBBQUHMAuGcHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBvc2l0b3J5
L0RFRkFVTFQvNzAvNDA1YmJkLTU5MTMtNGU5NS04ZTc1LWZlMDY1OTE3NmE1Ni8x
L19aWGpybWxMZldIUndZUS05ZzA0aHItZlFWay5yb2EwgYEGA1UdHwR6MHgwdqB0
oHKGcHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBvc2l0b3J5L0RFRkFVTFQvNzAv
NDA1YmJkLTU5MTMtNGU5NS04ZTc1LWZlMDY1OTE3NmE1Ni8xL0tzUGFvYkZJVVBM
bUhGa3JJWkdSV2w1bHBIZy5jcmwwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjBt
BggrBgEFBQcBBwEB/wReMFwwWgQCAAEwVAMEAVJzFAMEAlJzGAMEAlUIpAMEAFuE
OwMEALk7cwMEAbmBbAMEArnc7AMEArnqkAMEArn4uAMEAbz9AAMEAMEkSQMEAcEk
VAMEAtRXwAMEAtRaZDANBgkqhkiG9w0BAQsFAAOCAQEAghL9qPuTVFCLhWwa3hgq
LO5Du21RAeXqM39gTqmnUT55AKHv/iqqwVPJbpbBITkq1jKdodvMoZBMr5bGLSRP
ztJF5OATXl4Ighi8T6XioihybBp3hmfs9tXcY27caQ4bifUyjb4LYaOW8kqey7QM
eSC40sgk+KHaSq4RcXabgURqUCXZmf0N8oKCehkDy69JUI3GqjuyO5KIUbW82nF4
biY4C/+EDFYfFyEmnvTVjhFUzoDPTWpBAcBURUAn8bNpAjbHYbgVJGkEtf6CItgD
zJxUAzBMVxZ8HTGgPff6kfD51N4AHbz+XKlI1q76bY/cGpRXnwH6oOKMdcfVmVn7
Pg==
-----END CERTIFICATE-----