Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/76/1be999-5a59-4c10-92ff-da1b58618841/1/hRHBceamMyrHhZWxLHmK3i0vYcM.roa
File:                     hRHBceamMyrHhZWxLHmK3i0vYcM.roa (raw, json)
Hash identifier:          vHM4g8s8I7aMrZSnD+rEjrrkAsx/tk1PDttAcqSfQdk=
Subject key identifier:   85:11:C1:71:E6:A6:33:2A:C7:85:95:B1:2C:79:8A:DE:2D:2F:61:C3
Certificate issuer:       /CN=eefbe8369a7bbc03a86fbe639b7efaa02b717287
Certificate serial:       01856D8B00C0A690E90C743ACB6B4A259992
Authority key identifier: EE:FB:E8:36:9A:7B:BC:03:A8:6F:BE:63:9B:7E:FA:A0:2B:71:72:87
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/7vvoNpp7vAOob75jm376oCtxcoc.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/76/1be999-5a59-4c10-92ff-da1b58618841/1/hRHBceamMyrHhZWxLHmK3i0vYcM.roa
Signing time:             Sun 01 Jan 2023 13:35:04 +0000
ROA not before:           Sun 01 Jan 2023 13:35:04 +0000
ROA not after:            Mon 01 Jul 2024 00:00:00 +0000
asID:                     205719
IP address blocks:        2a0f:6287:10::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:85:6d:8b:00:c0:a6:90:e9:0c:74:3a:cb:6b:4a:25:99:92
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=eefbe8369a7bbc03a86fbe639b7efaa02b717287
        Validity
            Not Before: Jan  1 13:35:04 2023 GMT
            Not After : Jul  1 00:00:00 2024 GMT
        Subject: CN=8511c171e6a6332ac78595b12c798ade2d2f61c3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:9c:d2:ab:c8:0b:91:f6:5a:09:11:df:a5:1b:d7:
                    30:f7:67:e5:4d:90:5b:5b:96:a9:5a:a7:d7:31:e2:
                    5c:e7:bd:ba:c3:c4:ca:16:18:9c:6c:89:3c:ad:e9:
                    03:a4:57:88:00:f3:25:5a:7e:e6:07:be:bb:44:4f:
                    1e:9e:fb:81:bd:23:95:91:a9:69:f0:11:c1:3d:79:
                    54:af:d8:eb:d0:c7:71:f3:b9:8e:1c:a7:7c:f6:18:
                    ad:1b:70:29:30:55:68:a3:16:a5:ea:ef:5f:bb:d3:
                    bf:3e:95:37:90:cf:46:94:dd:a1:34:f7:5a:1f:20:
                    35:02:b2:68:8d:ce:07:fa:08:ba:0a:dc:b5:3a:5d:
                    db:51:37:1d:e0:81:ea:fc:b5:7b:22:9f:8d:fd:5a:
                    20:6a:2e:75:d3:30:8c:4e:46:98:88:41:13:f2:d9:
                    de:07:06:e5:fd:a4:42:c1:60:d6:d9:1a:88:07:3f:
                    c2:16:a2:32:4e:a5:4c:af:f0:55:35:71:3a:9e:f0:
                    6d:48:a4:5b:87:b2:5a:76:da:ae:4e:31:91:ec:ab:
                    6b:24:17:36:f7:6c:e3:0a:e9:a2:28:f2:f8:6d:1d:
                    41:9b:79:16:5e:74:59:35:ec:a6:67:6e:81:a0:6c:
                    5e:cb:4f:00:d2:52:07:a4:f7:ec:ab:3b:55:a0:38:
                    89:ab
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                85:11:C1:71:E6:A6:33:2A:C7:85:95:B1:2C:79:8A:DE:2D:2F:61:C3
            X509v3 Authority Key Identifier:
                keyid:EE:FB:E8:36:9A:7B:BC:03:A8:6F:BE:63:9B:7E:FA:A0:2B:71:72:87

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/7vvoNpp7vAOob75jm376oCtxcoc.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/76/1be999-5a59-4c10-92ff-da1b58618841/1/hRHBceamMyrHhZWxLHmK3i0vYcM.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/76/1be999-5a59-4c10-92ff-da1b58618841/1/7vvoNpp7vAOob75jm376oCtxcoc.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv6:
                  2a0f:6287:10::/48

    Signature Algorithm: sha256WithRSAEncryption
         1c:84:ec:b9:09:da:a3:4d:ea:f5:8d:6d:18:6c:6b:34:2b:70:
         f2:d2:26:11:d3:58:a8:0b:56:93:1c:37:96:84:f1:ed:bb:e3:
         7c:2f:3b:13:fd:4f:2c:e5:06:94:9f:71:ed:9b:61:16:d9:8e:
         b4:2f:f1:15:e9:07:07:23:15:81:bb:bf:70:e7:50:7c:90:f0:
         ca:29:57:d1:2c:fd:7e:82:93:fc:fc:ce:48:f9:6b:71:3e:ab:
         a8:91:77:aa:3f:27:e9:19:4a:1e:67:6c:56:b9:ce:36:e3:97:
         cc:9c:b6:ea:44:4f:9c:0f:43:1a:58:16:45:b9:eb:ad:77:4e:
         ca:1c:5d:3e:98:26:80:75:1f:2b:56:14:f0:57:e4:d3:dd:f3:
         42:d5:f6:a2:0a:0f:5d:cd:68:1c:d3:15:b9:1d:db:00:46:28:
         53:ca:c6:df:52:21:a1:f3:e9:d9:99:2f:bd:d8:10:4c:83:8b:
         d1:7b:1f:db:cc:bc:a0:02:c3:6a:24:f8:ae:03:73:40:c5:ff:
         9f:bd:50:c2:90:a1:e1:1f:6e:2f:ef:25:20:d9:f2:cf:08:0b:
         90:96:bb:86:f0:e6:8b:73:4e:4d:21:74:d6:d3:96:23:aa:33:
         76:09:28:02:5b:07:2e:f2:e2:bb:c0:02:f3:5c:80:46:51:6e:
         71:ea:84:6e
-----BEGIN CERTIFICATE-----
MIIFADCCA+igAwIBAgISAYVtiwDAppDpDHQ6y2tKJZmSMA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKGVlZmJlODM2OWE3YmJjMDNhODZmYmU2MzliN2VmYWEwMmI3
MTcyODcwHhcNMjMwMTAxMTMzNTA0WhcNMjQwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
Eyg4NTExYzE3MWU2YTYzMzJhYzc4NTk1YjEyYzc5OGFkZTJkMmY2MWMzMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNKryAuR9loJEd+lG9cw92flTZBb
W5apWqfXMeJc5726w8TKFhicbIk8rekDpFeIAPMlWn7mB767RE8envuBvSOVkalp
8BHBPXlUr9jr0Mdx87mOHKd89hitG3ApMFVooxal6u9fu9O/PpU3kM9GlN2hNPda
HyA1ArJojc4H+gi6Cty1Ol3bUTcd4IHq/LV7Ip+N/Vogai510zCMTkaYiEET8tne
Bwbl/aRCwWDW2RqIBz/CFqIyTqVMr/BVNXE6nvBtSKRbh7JadtquTjGR7KtrJBc2
92zjCumiKPL4bR1Bm3kWXnRZNeymZ26BoGxey08A0lIHpPfsqztVoDiJqwIDAQAB
o4ICDDCCAggwHQYDVR0OBBYEFIURwXHmpjMqx4WVsSx5it4tL2HDMB8GA1UdIwQY
MBaAFO776Daae7wDqG++Y5t++qArcXKHMA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvN3Z2b05wcDd2QU9vYjc1am0zNzZvQ3R4Y29jLmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC83Ni8xYmU5OTktNWE1OS00YzEwLTkyZmYt
ZGExYjU4NjE4ODQxLzEvaFJIQmNlYW1NeXJIaFpXeExIbUszaTB2WWNNLnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC83Ni8xYmU5OTktNWE1OS00YzEwLTkyZmYtZGExYjU4NjE4ODQx
LzEvN3Z2b05wcDd2QU9vYjc1am0zNzZvQ3R4Y29jLmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMCIGCCsGAQUFBwEHAQH/BBMwETAPBAIAAjAJAwcAKg9ihwAQ
MA0GCSqGSIb3DQEBCwUAA4IBAQAchOy5CdqjTer1jW0YbGs0K3Dy0iYR01ioC1aT
HDeWhPHtu+N8LzsT/U8s5QaUn3Htm2EW2Y60L/EV6QcHIxWBu79w51B8kPDKKVfR
LP1+gpP8/M5I+WtxPquokXeqPyfpGUoeZ2xWuc4245fMnLbqRE+cD0MaWBZFueut
d07KHF0+mCaAdR8rVhTwV+TT3fNC1faiCg9dzWgc0xW5HdsARihTysbfUiGh8+nZ
mS+92BBMg4vRex/bzLygAsNqJPiuA3NAxf+fvVDCkKHhH24v7yUg2fLPCAuQlruG
8OaLc05NIXTW05YjqjN2CSgCWwcu8uK7wALzXIBGUW5x6oRu
-----END CERTIFICATE-----