Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/73/7c7bf6-2bdf-4c7d-9aec-1ef1cee661ca/1/MjNJxN_dpSdwzS4b05pRmRMfXuE.roa
File:                     MjNJxN_dpSdwzS4b05pRmRMfXuE.roa (raw, json)
Hash identifier:          1WmWsAXL/ysjTTHu87Pf8XkgP231xAJYa6O6jeDb1sI=
Subject key identifier:   32:33:49:C4:DF:DD:A5:27:70:CD:2E:1B:D3:9A:51:99:13:1F:5E:E1
Certificate issuer:       /CN=4be1bbbe540079d2b7f270b92ceaf3b2a816e8fa
Certificate serial:       0182C58F8F4F5E3E8DCDF48941DFF26EB528
Authority key identifier: 4B:E1:BB:BE:54:00:79:D2:B7:F2:70:B9:2C:EA:F3:B2:A8:16:E8:FA
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/S-G7vlQAedK38nC5LOrzsqgW6Po.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/73/7c7bf6-2bdf-4c7d-9aec-1ef1cee661ca/1/MjNJxN_dpSdwzS4b05pRmRMfXuE.roa
Signing time:             Mon 22 Aug 2022 12:38:15 +0000
ROA not before:           Mon 22 Aug 2022 12:38:15 +0000
ROA not after:            Sat 01 Jul 2023 00:00:00 +0000
asID:                     204339
IP address blocks:        2a13:3307::/32 maxlen: 32
                          2a06:ddc1::/32 maxlen: 32
                          2a06:ddc0::/32 maxlen: 32
                          2a06:ddc3::/32 maxlen: 32

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:82:c5:8f:8f:4f:5e:3e:8d:cd:f4:89:41:df:f2:6e:b5:28
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=4be1bbbe540079d2b7f270b92ceaf3b2a816e8fa
        Validity
            Not Before: Aug 22 12:38:15 2022 GMT
            Not After : Jul  1 00:00:00 2023 GMT
        Subject: CN=323349c4dfdda52770cd2e1bd39a5199131f5ee1
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b2:a6:67:e3:66:e2:25:17:fa:5e:cd:69:75:ae:
                    84:17:02:c0:3e:01:d8:bf:ee:7c:a4:ed:62:96:fc:
                    68:fe:6e:a5:e8:d4:4a:06:17:6f:02:ec:3d:69:b6:
                    7a:b8:36:5a:55:21:d5:0d:47:87:0d:44:16:73:db:
                    5d:a8:fb:c4:b2:f0:2a:b1:07:b5:3e:c8:95:20:9a:
                    87:1f:85:30:f3:59:26:0a:b4:ef:bb:fd:94:81:b1:
                    09:42:90:0f:8d:85:c2:f2:1e:5c:aa:ba:a0:58:c2:
                    98:bc:82:2f:07:13:1a:bf:0e:b3:7d:eb:d4:a8:8b:
                    fd:07:c1:97:8f:5f:97:94:86:72:5c:1d:ff:8e:84:
                    27:1a:d6:c1:94:7a:2b:bb:d5:38:d7:a3:96:8e:5d:
                    fc:99:bf:58:a4:10:f9:e0:7a:62:c2:c1:9f:21:72:
                    87:be:1c:87:fd:c0:96:e3:fe:f5:43:d3:dc:db:84:
                    52:f4:e5:32:36:6d:2e:a8:38:c7:68:70:58:20:7e:
                    0d:9e:55:d4:9b:d1:1e:cc:34:36:87:c9:70:6e:5b:
                    d2:9c:ab:a3:94:7a:60:0a:c2:e6:e8:ad:71:6d:f6:
                    ac:88:60:af:f9:79:50:05:94:05:65:82:1f:66:cb:
                    1f:24:3a:f5:6c:77:25:bd:08:ea:14:79:02:aa:76:
                    e7:b3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                32:33:49:C4:DF:DD:A5:27:70:CD:2E:1B:D3:9A:51:99:13:1F:5E:E1
            X509v3 Authority Key Identifier:
                keyid:4B:E1:BB:BE:54:00:79:D2:B7:F2:70:B9:2C:EA:F3:B2:A8:16:E8:FA

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/S-G7vlQAedK38nC5LOrzsqgW6Po.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/73/7c7bf6-2bdf-4c7d-9aec-1ef1cee661ca/1/MjNJxN_dpSdwzS4b05pRmRMfXuE.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/73/7c7bf6-2bdf-4c7d-9aec-1ef1cee661ca/1/S-G7vlQAedK38nC5LOrzsqgW6Po.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv6:
                  2a06:ddc0::/31
                  2a06:ddc3::/32
                  2a13:3307::/32

    Signature Algorithm: sha256WithRSAEncryption
         66:8b:e6:19:1a:5e:0a:aa:0c:66:a7:13:d2:14:5f:f7:04:18:
         3b:ab:f4:25:20:fd:a9:f9:a7:06:f6:a2:71:b0:3a:00:61:1d:
         ae:c9:0c:97:70:96:06:9f:46:30:2b:7b:06:95:42:b1:ea:26:
         13:8c:0b:18:a3:8d:84:6b:a9:85:b0:b3:1b:0c:82:22:49:31:
         b5:f3:67:e6:aa:e1:9d:a4:eb:95:7b:a3:f2:df:3e:b4:0f:cc:
         f4:d1:98:b4:07:29:bd:74:a5:44:da:e5:b5:1f:50:77:7c:4b:
         82:51:95:b8:ee:69:2e:c6:09:d5:f2:77:0a:0a:da:f4:ee:41:
         4d:7e:4e:38:12:3c:fb:f8:8c:9a:90:42:2f:3f:2e:1e:9d:0c:
         b2:53:d3:9d:4f:cb:5b:b2:a4:ca:db:29:b1:50:ad:29:fa:9d:
         9c:70:5e:83:79:dc:2d:6d:fb:c4:a1:30:fd:bb:4c:da:d2:e6:
         4a:8d:c3:01:b3:1d:aa:a6:c4:8d:dc:a3:fa:23:f9:03:e3:ed:
         86:cd:ec:eb:5b:67:53:88:3c:e2:cd:70:24:aa:a6:32:36:e1:
         52:8a:1d:87:d3:b0:32:43:21:90:68:21:17:6c:98:66:58:83:
         ef:10:5e:9d:ab:98:95:f2:e2:7e:68:a3:cf:60:c3:54:a9:d9:
         47:f0:a3:85
-----BEGIN CERTIFICATE-----
MIIFDDCCA/SgAwIBAgISAYLFj49PXj6NzfSJQd/ybrUoMA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKDRiZTFiYmJlNTQwMDc5ZDJiN2YyNzBiOTJjZWFmM2IyYTgx
NmU4ZmEwHhcNMjIwODIyMTIzODE1WhcNMjMwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
EygzMjMzNDljNGRmZGRhNTI3NzBjZDJlMWJkMzlhNTE5OTEzMWY1ZWUxMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsqZn42biJRf6Xs1pda6EFwLAPgHY
v+58pO1ilvxo/m6l6NRKBhdvAuw9abZ6uDZaVSHVDUeHDUQWc9tdqPvEsvAqsQe1
PsiVIJqHH4Uw81kmCrTvu/2UgbEJQpAPjYXC8h5cqrqgWMKYvIIvBxMavw6zfevU
qIv9B8GXj1+XlIZyXB3/joQnGtbBlHoru9U416OWjl38mb9YpBD54HpiwsGfIXKH
vhyH/cCW4/71Q9Pc24RS9OUyNm0uqDjHaHBYIH4NnlXUm9EezDQ2h8lwblvSnKuj
lHpgCsLm6K1xbfasiGCv+XlQBZQFZYIfZssfJDr1bHclvQjqFHkCqnbnswIDAQAB
o4ICGDCCAhQwHQYDVR0OBBYEFDIzScTf3aUncM0uG9OaUZkTH17hMB8GA1UdIwQY
MBaAFEvhu75UAHnSt/JwuSzq87KoFuj6MA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvUy1HN3ZsUUFlZEszOG5DNUxPcnpzcWdXNlBvLmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC83My83YzdiZjYtMmJkZi00YzdkLTlhZWMt
MWVmMWNlZTY2MWNhLzEvTWpOSnhOX2RwU2R3elM0YjA1cFJtUk1mWHVFLnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC83My83YzdiZjYtMmJkZi00YzdkLTlhZWMtMWVmMWNlZTY2MWNh
LzEvUy1HN3ZsUUFlZEszOG5DNUxPcnpzcWdXNlBvLmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMC4GCCsGAQUFBwEHAQH/BB8wHTAbBAIAAjAVAwUBKgbdwAMF
ACoG3cMDBQAqEzMHMA0GCSqGSIb3DQEBCwUAA4IBAQBmi+YZGl4KqgxmpxPSFF/3
BBg7q/QlIP2p+acG9qJxsDoAYR2uyQyXcJYGn0YwK3sGlUKx6iYTjAsYo42Ea6mF
sLMbDIIiSTG182fmquGdpOuVe6Py3z60D8z00Zi0Bym9dKVE2uW1H1B3fEuCUZW4
7mkuxgnV8ncKCtr07kFNfk44Ejz7+IyakEIvPy4enQyyU9OdT8tbsqTK2ymxUK0p
+p2ccF6DedwtbfvEoTD9u0za0uZKjcMBsx2qpsSN3KP6I/kD4+2GzezrW2dTiDzi
zXAkqqYyNuFSih2H07AyQyGQaCEXbJhmWIPvEF6dq5iV8uJ+aKPPYMNUqdlH8KOF
-----END CERTIFICATE-----