Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/84/431df1-09f4-475c-a045-f5bb2843c89e/1/XtNYT_Dj5Z5A6MQbH_1BYVuV9DQ.roa
File:                     XtNYT_Dj5Z5A6MQbH_1BYVuV9DQ.roa (raw, json)
Hash identifier:          BMTr2ccM98F11g7cRkVNxsvAE8csx8v/5iMv+Aj9aho=
Subject key identifier:   5E:D3:58:4F:F0:E3:E5:9E:40:E8:C4:1B:1F:FD:41:61:5B:95:F4:34
Certificate issuer:       /CN=7e2cb3d0a641769c7801c481612015c2ccb3b655
Certificate serial:       018CC6B89158D23B0EA648B5A5DB1885616F
Authority key identifier: 7E:2C:B3:D0:A6:41:76:9C:78:01:C4:81:61:20:15:C2:CC:B3:B6:55
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/fiyz0KZBdpx4AcSBYSAVwsyztlU.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/84/431df1-09f4-475c-a045-f5bb2843c89e/1/XtNYT_Dj5Z5A6MQbH_1BYVuV9DQ.roa
Signing time:             Mon 01 Jan 2024 20:30:33 +0000
ROA not before:           Mon 01 Jan 2024 20:30:33 +0000
ROA not after:            Tue 01 Jul 2025 00:00:00 +0000
asID:                     8943
IP address blocks:        46.255.72.0/21 maxlen: 21
                          46.255.72.0/22 maxlen: 22
                          2a00:a400::/32 maxlen: 32

Validation:               OK
Signature path:           rsync://rpki.ripe.net/repository/DEFAULT/84/431df1-09f4-475c-a045-f5bb2843c89e/1/fiyz0KZBdpx4AcSBYSAVwsyztlU.crl
                          rsync://rpki.ripe.net/repository/DEFAULT/84/431df1-09f4-475c-a045-f5bb2843c89e/1/fiyz0KZBdpx4AcSBYSAVwsyztlU.mft
                          rsync://rpki.ripe.net/repository/DEFAULT/fiyz0KZBdpx4AcSBYSAVwsyztlU.cer
                          rsync://rpki.ripe.net/repository/DEFAULT/KpSo3VVK5wEHIJnHC2QHVV3d5mk.crl
                          rsync://rpki.ripe.net/repository/DEFAULT/KpSo3VVK5wEHIJnHC2QHVV3d5mk.mft
                          rsync://rpki.ripe.net/repository/aca/KpSo3VVK5wEHIJnHC2QHVV3d5mk.cer
                          rsync://rpki.ripe.net/repository/aca/7DNNDzoYvgAht7joQih2Qayxcxo.crl
                          rsync://rpki.ripe.net/repository/aca/7DNNDzoYvgAht7joQih2Qayxcxo.mft
                          rsync://rpki.ripe.net/repository/ec334d0f3a18be0021b7b8e842287641acb1731a.cer
                          rsync://rpki.ripe.net/repository/ripe-ncc-ta.crl
                          rsync://rpki.ripe.net/repository/ripe-ncc-ta.mft
                          rsync://rpki.ripe.net/ta/ripe-ncc-ta.cer
Signature path expires:   Sat 23 Nov 2024 12:00:10 +0000

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8c:c6:b8:91:58:d2:3b:0e:a6:48:b5:a5:db:18:85:61:6f
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=7e2cb3d0a641769c7801c481612015c2ccb3b655
        Validity
            Not Before: Jan  1 20:30:33 2024 GMT
            Not After : Jul  1 00:00:00 2025 GMT
        Subject: CN=5ed3584ff0e3e59e40e8c41b1ffd41615b95f434
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:b2:3a:94:9c:da:7e:0e:38:9a:21:00:18:1a:40:
                    20:24:c7:33:bb:8c:76:83:3f:12:b3:b0:d1:1c:73:
                    0f:c8:36:38:b6:07:dd:d6:f2:d8:8e:35:96:5c:6a:
                    71:d2:98:29:5c:a5:a1:cf:2d:f1:fa:f1:6d:ee:d1:
                    94:37:d3:85:1d:fe:68:82:a3:d4:ea:ab:94:32:7b:
                    93:2f:e2:c2:83:cb:0b:0b:05:0e:10:48:1a:d7:5c:
                    77:cd:ce:80:4a:13:43:b9:d3:fe:27:48:a4:3c:30:
                    34:87:3d:3a:9f:df:bc:07:b4:12:a9:74:81:01:4b:
                    4b:97:0b:db:73:f8:2c:34:19:ba:62:b0:b8:cb:9e:
                    aa:d0:3e:f8:fa:bc:ac:9a:08:dc:1e:c4:e3:56:a0:
                    9c:f4:93:58:22:04:bd:90:a6:f0:03:97:17:ae:fc:
                    3e:4f:3d:02:90:fe:74:e7:07:57:f6:dc:1a:bf:3c:
                    97:80:41:f3:08:92:3f:88:3d:59:69:b2:6c:ec:15:
                    c6:22:f5:61:72:1b:d9:41:40:10:79:38:18:1f:26:
                    75:1a:89:f5:6f:5f:b3:16:b1:3c:a7:e8:1a:dd:69:
                    91:08:12:9b:7d:98:98:4a:2c:df:89:0f:2b:70:d8:
                    64:8b:f7:41:aa:f3:72:e6:bd:02:77:88:14:09:86:
                    c2:73
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                5E:D3:58:4F:F0:E3:E5:9E:40:E8:C4:1B:1F:FD:41:61:5B:95:F4:34
            X509v3 Authority Key Identifier:
                keyid:7E:2C:B3:D0:A6:41:76:9C:78:01:C4:81:61:20:15:C2:CC:B3:B6:55

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/fiyz0KZBdpx4AcSBYSAVwsyztlU.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/84/431df1-09f4-475c-a045-f5bb2843c89e/1/XtNYT_Dj5Z5A6MQbH_1BYVuV9DQ.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/84/431df1-09f4-475c-a045-f5bb2843c89e/1/fiyz0KZBdpx4AcSBYSAVwsyztlU.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv4:
                  46.255.72.0/21
                IPv6:
                  2a00:a400::/32

    Signature Algorithm: sha256WithRSAEncryption
         50:f5:b7:c4:ec:cc:26:ea:af:09:0d:30:0b:c1:1c:48:84:b1:
         af:aa:06:7d:d9:5c:9c:fa:5d:62:c9:ae:a8:20:aa:7f:93:e1:
         7d:45:93:73:f6:18:c5:a1:4b:ab:b5:cc:6c:14:ba:17:16:03:
         8d:64:d4:b8:26:f9:e1:1b:66:c7:56:ea:69:0a:37:a8:da:9f:
         31:77:32:78:fa:09:0d:a2:1a:e5:f6:26:03:df:d4:8d:e0:81:
         c4:45:2d:d4:03:53:34:f5:84:db:c2:bc:6a:4a:25:b6:89:b1:
         5c:5e:e2:a5:84:61:94:37:44:7f:bd:d7:7c:5d:49:08:ef:75:
         be:52:83:fe:5d:c8:be:d4:9f:b6:eb:f6:98:0e:77:69:35:3c:
         b9:9e:db:50:9e:46:c7:b5:7e:f7:36:2a:7d:fd:c4:6b:79:f0:
         7a:f9:30:56:2a:22:a6:d9:61:0f:7c:5f:97:91:de:32:c8:4f:
         54:2f:c3:63:77:37:26:3f:10:2b:53:df:e3:26:1f:d7:73:ee:
         dc:ab:07:0a:30:43:9e:ce:a1:2f:9c:c3:bf:b8:3a:24:55:6c:
         e4:24:56:e3:d4:bd:a2:7d:e4:84:16:26:84:a8:0e:8c:94:d2:
         09:65:5e:20:d2:5c:85:dd:88:0c:a9:e0:64:e0:03:bd:21:f6:
         83:bd:a4:4c
-----BEGIN CERTIFICATE-----
MIIFDDCCA/SgAwIBAgISAYzGuJFY0jsOpki1pdsYhWFvMA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKDdlMmNiM2QwYTY0MTc2OWM3ODAxYzQ4MTYxMjAxNWMyY2Ni
M2I2NTUwHhcNMjQwMTAxMjAzMDMzWhcNMjUwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
Eyg1ZWQzNTg0ZmYwZTNlNTllNDBlOGM0MWIxZmZkNDE2MTViOTVmNDM0MIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsjqUnNp+DjiaIQAYGkAgJMczu4x2
gz8Ss7DRHHMPyDY4tgfd1vLYjjWWXGpx0pgpXKWhzy3x+vFt7tGUN9OFHf5ogqPU
6quUMnuTL+LCg8sLCwUOEEga11x3zc6AShNDudP+J0ikPDA0hz06n9+8B7QSqXSB
AUtLlwvbc/gsNBm6YrC4y56q0D74+rysmgjcHsTjVqCc9JNYIgS9kKbwA5cXrvw+
Tz0CkP505wdX9twavzyXgEHzCJI/iD1ZabJs7BXGIvVhchvZQUAQeTgYHyZ1Gon1
b1+zFrE8p+ga3WmRCBKbfZiYSizfiQ8rcNhki/dBqvNy5r0Cd4gUCYbCcwIDAQAB
o4ICGDCCAhQwHQYDVR0OBBYEFF7TWE/w4+WeQOjEGx/9QWFblfQ0MB8GA1UdIwQY
MBaAFH4ss9CmQXaceAHEgWEgFcLMs7ZVMA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvZml5ejBLWkJkcHg0QWNTQllTQVZ3c3l6dGxVLmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC84NC80MzFkZjEtMDlmNC00NzVjLWEwNDUt
ZjViYjI4NDNjODllLzEvWHROWVRfRGo1WjVBNk1RYkhfMUJZVnVWOURRLnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC84NC80MzFkZjEtMDlmNC00NzVjLWEwNDUtZjViYjI4NDNjODll
LzEvZml5ejBLWkJkcHg0QWNTQllTQVZ3c3l6dGxVLmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMC4GCCsGAQUFBwEHAQH/BB8wHTAMBAIAATAGAwQDLv9IMA0E
AgACMAcDBQAqAKQAMA0GCSqGSIb3DQEBCwUAA4IBAQBQ9bfE7Mwm6q8JDTALwRxI
hLGvqgZ92Vyc+l1iya6oIKp/k+F9RZNz9hjFoUurtcxsFLoXFgONZNS4JvnhG2bH
VuppCjeo2p8xdzJ4+gkNohrl9iYD39SN4IHERS3UA1M09YTbwrxqSiW2ibFcXuKl
hGGUN0R/vdd8XUkI73W+UoP+Xci+1J+26/aYDndpNTy5nttQnkbHtX73Nip9/cRr
efB6+TBWKiKm2WEPfF+Xkd4yyE9UL8NjdzcmPxArU9/jJh/Xc+7cqwcKMEOezqEv
nMO/uDokVWzkJFbj1L2ifeSEFiaEqA6MlNIJZV4g0lyF3YgMqeBk4AO9IfaDvaRM
-----END CERTIFICATE-----