Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/8f/ff94f1-ba63-40d6-beca-5e624a3038cf/1/cjEgx19Wfz-AcQp-9E3WFkDcT6A.roa
File:                     cjEgx19Wfz-AcQp-9E3WFkDcT6A.roa (raw, json)
Hash identifier:          TJrcFzM192LMccBUISGEYs/gqLfMBd2eT+07PMkqSd0=
Subject key identifier:   72:31:20:C7:5F:56:7F:3F:80:71:0A:7E:F4:4D:D6:16:40:DC:4F:A0
Certificate issuer:       /CN=9c1aed9913f8880af7557eef3ef02d6e0ff3fd49
Certificate serial:       0182E85A0616BBEAC58591BCF0419120E264
Authority key identifier: 9C:1A:ED:99:13:F8:88:0A:F7:55:7E:EF:3E:F0:2D:6E:0F:F3:FD:49
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/nBrtmRP4iAr3VX7vPvAtbg_z_Uk.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/8f/ff94f1-ba63-40d6-beca-5e624a3038cf/1/cjEgx19Wfz-AcQp-9E3WFkDcT6A.roa
Signing time:             Mon 29 Aug 2022 06:46:29 +0000
ROA not before:           Mon 29 Aug 2022 06:46:29 +0000
ROA not after:            Sat 01 Jul 2023 00:00:00 +0000
asID:                     61439
IP address blocks:        194.8.28.0/24 maxlen: 24
                          2a0d:8041::/32 maxlen: 32
                          2a0f:a1c1::/32 maxlen: 32
                          2a0d:8044::/32 maxlen: 32
                          2a0f:a1c4::/32 maxlen: 32
                          2a0d:8045::/32 maxlen: 32
                          2a0f:a1c5::/32 maxlen: 32
                          2a0f:a1c2::/32 maxlen: 32
                          2a0d:8042::/32 maxlen: 32
                          2a0d:8043::/32 maxlen: 32
                          2a0f:a1c3::/32 maxlen: 32
                          2a0f:a1c7::/32 maxlen: 32
                          2a0d:8047::/32 maxlen: 32
                          2a0d:8040::/32 maxlen: 32
                          2a0f:a1c0::/32 maxlen: 32
                          2a0d:8046::/32 maxlen: 32
                          2a0f:a1c6::/32 maxlen: 32

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:82:e8:5a:06:16:bb:ea:c5:85:91:bc:f0:41:91:20:e2:64
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=9c1aed9913f8880af7557eef3ef02d6e0ff3fd49
        Validity
            Not Before: Aug 29 06:46:29 2022 GMT
            Not After : Jul  1 00:00:00 2023 GMT
        Subject: CN=723120c75f567f3f80710a7ef44dd61640dc4fa0
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:81:ae:ea:97:0a:e3:eb:8d:57:1d:c4:c6:85:1c:
                    ce:63:b8:c8:92:5b:9e:de:a4:75:8a:74:af:a8:1d:
                    26:9a:4e:b4:51:15:5d:d5:9e:76:33:b2:5c:51:56:
                    59:7d:94:41:b6:42:e9:18:91:9b:b0:b6:21:83:70:
                    02:dc:fe:2c:d0:8b:cf:36:14:3b:c1:4d:6a:16:70:
                    9c:f2:7c:25:44:4a:96:16:9d:b6:d4:07:58:13:49:
                    a2:5e:c6:90:17:60:d2:a0:64:c8:b9:2d:af:52:09:
                    f3:0f:89:7d:4d:0c:0b:00:56:5c:c4:8a:de:b5:f9:
                    9e:5c:cf:7d:ce:ab:13:cd:24:b8:7f:68:66:14:d9:
                    5b:48:70:7c:0d:e1:b0:66:a0:fc:a2:17:d9:c1:9f:
                    a4:58:a3:e3:7b:63:51:2e:b4:e6:80:04:30:df:9d:
                    d1:3f:51:80:44:d7:58:01:97:ad:1e:f6:95:f2:70:
                    ae:0a:e5:46:ef:c7:91:a8:c9:cc:ea:9d:10:21:0e:
                    8f:ff:3d:e0:1b:ea:c6:4e:5c:8f:e3:68:24:0b:75:
                    a8:cb:c6:74:4f:89:4a:3f:a6:91:74:27:57:9b:a7:
                    73:af:4b:ac:0b:78:b5:32:52:ea:91:d9:cd:07:62:
                    8f:ff:9a:1c:fe:69:16:17:fe:ec:86:de:9f:e7:31:
                    28:61
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                72:31:20:C7:5F:56:7F:3F:80:71:0A:7E:F4:4D:D6:16:40:DC:4F:A0
            X509v3 Authority Key Identifier:
                keyid:9C:1A:ED:99:13:F8:88:0A:F7:55:7E:EF:3E:F0:2D:6E:0F:F3:FD:49

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/nBrtmRP4iAr3VX7vPvAtbg_z_Uk.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/8f/ff94f1-ba63-40d6-beca-5e624a3038cf/1/cjEgx19Wfz-AcQp-9E3WFkDcT6A.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/8f/ff94f1-ba63-40d6-beca-5e624a3038cf/1/nBrtmRP4iAr3VX7vPvAtbg_z_Uk.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv4:
                  194.8.28.0/24
                IPv6:
                  2a0d:8040::/29
                  2a0f:a1c0::/29

    Signature Algorithm: sha256WithRSAEncryption
         9a:27:11:f7:3e:79:1d:2c:eb:c7:36:6b:6b:2b:d0:e8:27:f4:
         36:5b:6b:18:ae:38:e1:11:e2:c0:d6:50:2c:f9:4a:eb:b5:2f:
         7c:b9:a2:3b:2e:d6:21:6f:bf:44:42:13:34:ef:0b:4c:8c:0e:
         10:56:30:4f:23:83:e3:83:aa:25:d4:8f:fe:db:96:46:a0:e7:
         44:90:94:57:74:a7:5d:2a:6a:01:11:5b:cc:8b:67:04:48:92:
         4d:52:9c:29:61:32:06:09:36:ee:85:89:67:43:ed:10:e4:0f:
         38:21:bc:8f:54:ef:cc:37:78:e6:d8:47:05:df:7c:5e:24:6f:
         f5:43:4d:47:c0:d3:bb:7c:6d:ce:80:8a:87:3b:3d:7a:e1:77:
         75:c3:37:22:28:d6:a4:a4:a3:bd:9c:f8:f1:3a:aa:17:50:f1:
         e4:b6:79:a4:53:98:a1:fa:86:e1:9c:6f:4e:6a:70:1f:82:a6:
         62:fa:14:48:fd:b3:93:33:9d:04:9b:d7:5d:49:50:53:c4:02:
         1d:09:39:9f:29:e8:79:d5:31:d5:3a:5a:b4:21:c0:aa:6a:c8:
         8f:97:a0:a4:77:1a:3b:bc:56:07:a8:e7:be:ed:27:56:01:1a:
         5e:0e:23:69:53:c3:98:43:12:4c:c0:62:ff:f9:b2:d5:bb:7c:
         47:cc:57:c6
-----BEGIN CERTIFICATE-----
MIIFEzCCA/ugAwIBAgISAYLoWgYWu+rFhZG88EGRIOJkMA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKDljMWFlZDk5MTNmODg4MGFmNzU1N2VlZjNlZjAyZDZlMGZm
M2ZkNDkwHhcNMjIwODI5MDY0NjI5WhcNMjMwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
Eyg3MjMxMjBjNzVmNTY3ZjNmODA3MTBhN2VmNDRkZDYxNjQwZGM0ZmEwMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAga7qlwrj641XHcTGhRzOY7jIklue
3qR1inSvqB0mmk60URVd1Z52M7JcUVZZfZRBtkLpGJGbsLYhg3AC3P4s0IvPNhQ7
wU1qFnCc8nwlREqWFp221AdYE0miXsaQF2DSoGTIuS2vUgnzD4l9TQwLAFZcxIre
tfmeXM99zqsTzSS4f2hmFNlbSHB8DeGwZqD8ohfZwZ+kWKPje2NRLrTmgAQw353R
P1GARNdYAZetHvaV8nCuCuVG78eRqMnM6p0QIQ6P/z3gG+rGTlyP42gkC3Woy8Z0
T4lKP6aRdCdXm6dzr0usC3i1MlLqkdnNB2KP/5oc/mkWF/7sht6f5zEoYQIDAQAB
o4ICHzCCAhswHQYDVR0OBBYEFHIxIMdfVn8/gHEKfvRN1hZA3E+gMB8GA1UdIwQY
MBaAFJwa7ZkT+IgK91V+7z7wLW4P8/1JMA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvbkJydG1SUDRpQXIzVlg3dlB2QXRiZ196X1VrLmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC84Zi9mZjk0ZjEtYmE2My00MGQ2LWJlY2Et
NWU2MjRhMzAzOGNmLzEvY2pFZ3gxOVdmei1BY1FwLTlFM1dGa0RjVDZBLnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC84Zi9mZjk0ZjEtYmE2My00MGQ2LWJlY2EtNWU2MjRhMzAzOGNm
LzEvbkJydG1SUDRpQXIzVlg3dlB2QXRiZ196X1VrLmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMDUGCCsGAQUFBwEHAQH/BCYwJDAMBAIAATAGAwQAwggcMBQE
AgACMA4DBQMqDYBAAwUDKg+hwDANBgkqhkiG9w0BAQsFAAOCAQEAmicR9z55HSzr
xzZrayvQ6Cf0NltrGK444RHiwNZQLPlK67UvfLmiOy7WIW+/REITNO8LTIwOEFYw
TyOD44OqJdSP/tuWRqDnRJCUV3SnXSpqARFbzItnBEiSTVKcKWEyBgk27oWJZ0Pt
EOQPOCG8j1TvzDd45thHBd98XiRv9UNNR8DTu3xtzoCKhzs9euF3dcM3IijWpKSj
vZz48TqqF1Dx5LZ5pFOYofqG4ZxvTmpwH4KmYvoUSP2zkzOdBJvXXUlQU8QCHQk5
nynoedUx1TpatCHAqmrIj5egpHcaO7xWB6jnvu0nVgEaXg4jaVPDmEMSTMBi//my
1bt8R8xXxg==
-----END CERTIFICATE-----