Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/98/207934-9edc-4a89-820e-d8488b3ab42f/1/HYAlw4oLjyRrT-1zXn3RzZG4YQg.roa
File:                     HYAlw4oLjyRrT-1zXn3RzZG4YQg.roa (raw, json)
Hash identifier:          j9inyNajq/fyHxFhce+tmZecAUeciw7thJiEFrtYjpo=
Subject key identifier:   1D:80:25:C3:8A:0B:8F:24:6B:4F:ED:73:5E:7D:D1:CD:91:B8:61:08
Certificate issuer:       /CN=81c8b73ab7bdeb76ff48b2ca099616edbe71c426
Certificate serial:       018CC72753CBA155A0780E9567A13E664301
Authority key identifier: 81:C8:B7:3A:B7:BD:EB:76:FF:48:B2:CA:09:96:16:ED:BE:71:C4:26
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/gci3Ore963b_SLLKCZYW7b5xxCY.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/98/207934-9edc-4a89-820e-d8488b3ab42f/1/HYAlw4oLjyRrT-1zXn3RzZG4YQg.roa
Signing time:             Mon 01 Jan 2024 22:31:32 +0000
ROA not before:           Mon 01 Jan 2024 22:31:32 +0000
ROA not after:            Tue 01 Jul 2025 00:00:00 +0000
asID:                     212144
IP address blocks:        2a09:dc00::/32 maxlen: 32
                          2a0a:1f45::/32 maxlen: 32
                          2a0a:1f41::/32 maxlen: 32
                          2a0a:1f44::/32 maxlen: 32
                          2a0a:da40::/29 maxlen: 29
                          2a09:dc03::/32 maxlen: 32
                          2a09:dc00::/29 maxlen: 29
                          2a0a:1f43::/32 maxlen: 32
                          2a09:dc06::/32 maxlen: 32
                          2a09:dc05::/32 maxlen: 32
                          2a09:dc02::/32 maxlen: 32
                          2a09:dc01::/32 maxlen: 32
                          2a09:dc04::/32 maxlen: 32
                          2a09:dc07::/32 maxlen: 32

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8c:c7:27:53:cb:a1:55:a0:78:0e:95:67:a1:3e:66:43:01
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=81c8b73ab7bdeb76ff48b2ca099616edbe71c426
        Validity
            Not Before: Jan  1 22:31:32 2024 GMT
            Not After : Jul  1 00:00:00 2025 GMT
        Subject: CN=1d8025c38a0b8f246b4fed735e7dd1cd91b86108
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ae:df:4d:32:00:3f:ce:fc:7a:8a:f3:f1:39:98:
                    2f:b4:be:0b:f8:9f:5d:f3:23:22:b3:17:50:3a:c0:
                    8a:4b:24:eb:76:c8:55:9e:1b:f3:e8:ae:62:8b:dc:
                    41:79:73:13:8d:8b:91:40:7d:23:9c:7f:e8:a3:32:
                    a8:18:6a:a0:81:b7:bd:ed:77:96:11:e1:77:bb:cf:
                    d5:2b:da:c3:94:d8:6a:97:0c:94:b6:70:ca:fb:9e:
                    d0:b8:01:0a:b5:45:b9:d3:28:75:42:f8:af:4c:48:
                    6f:09:6a:e8:10:31:42:bb:f5:2a:87:10:fb:9d:3a:
                    61:d0:7f:3d:db:82:8f:c9:b4:26:2a:ca:d1:9e:71:
                    21:23:49:be:18:29:d5:9a:b3:53:62:41:99:2b:9d:
                    98:71:49:28:8e:71:dc:14:09:d7:7e:87:e2:2d:f0:
                    c5:8a:b4:f5:d7:54:ce:31:0e:f0:a3:3b:84:1b:75:
                    bf:54:b1:9e:17:88:73:03:ff:3e:ba:6d:30:b8:50:
                    f5:07:1c:79:73:7f:1c:2c:4e:80:a4:47:6d:61:57:
                    cc:49:6d:73:5d:78:e2:60:d7:25:2a:14:70:75:22:
                    39:b2:a1:73:52:78:a0:8b:8b:93:06:74:f2:64:fc:
                    a9:c5:0c:c6:ed:a3:65:e4:c4:21:2f:e8:09:fa:6e:
                    8b:29
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                1D:80:25:C3:8A:0B:8F:24:6B:4F:ED:73:5E:7D:D1:CD:91:B8:61:08
            X509v3 Authority Key Identifier:
                keyid:81:C8:B7:3A:B7:BD:EB:76:FF:48:B2:CA:09:96:16:ED:BE:71:C4:26

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/gci3Ore963b_SLLKCZYW7b5xxCY.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/98/207934-9edc-4a89-820e-d8488b3ab42f/1/HYAlw4oLjyRrT-1zXn3RzZG4YQg.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/98/207934-9edc-4a89-820e-d8488b3ab42f/1/gci3Ore963b_SLLKCZYW7b5xxCY.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv6:
                  2a09:dc00::/29
                  2a0a:1f41::/32
                  2a0a:1f43::-2a0a:1f45:ffff:ffff:ffff:ffff:ffff:ffff
                  2a0a:da40::/29

    Signature Algorithm: sha256WithRSAEncryption
         6c:c5:83:1f:c3:03:a0:cb:95:d9:b4:71:74:6a:b2:0c:6a:17:
         0b:86:cd:14:d5:04:f1:0b:69:ae:12:f4:1a:8f:1c:07:97:82:
         c2:a7:32:49:71:8c:a3:f1:5b:73:cc:b1:90:1b:d9:e3:61:fc:
         ba:7f:b2:08:99:8e:03:3f:8a:0d:e8:26:ca:4e:17:bc:d6:c8:
         4a:b5:cd:bc:7b:6e:4b:91:34:6d:9f:1d:ce:b7:dd:ac:98:db:
         a2:75:57:a2:2c:73:35:ba:d9:5e:5c:be:e5:10:13:6e:29:9b:
         c0:72:22:43:18:f4:af:a1:80:6f:62:45:12:d5:c0:81:40:82:
         f7:fd:02:2a:2f:fa:52:9b:7b:f9:a7:45:86:14:ee:ab:1e:35:
         2b:9a:4e:95:e8:ab:8a:6c:0b:c0:30:4e:4d:7a:12:dc:3f:f1:
         26:8c:5f:d2:f1:98:4f:c9:1a:ef:48:a1:d1:22:c4:11:f4:e1:
         e2:a6:81:48:83:a8:7e:82:40:e8:2f:a1:b2:1a:67:74:c7:8a:
         5c:9e:d6:1f:a0:f9:f1:4c:61:36:1b:5d:4d:b9:cb:c5:1d:f0:
         3e:5d:0e:2d:f2:2b:8d:87:34:37:c4:d0:ff:30:02:6c:a5:23:
         67:d6:74:c2:aa:fa:9d:a4:0a:92:6a:65:cc:a8:05:73:7b:d6:
         71:0f:26:42
-----BEGIN CERTIFICATE-----
MIIFHDCCBASgAwIBAgISAYzHJ1PLoVWgeA6VZ6E+ZkMBMA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKDgxYzhiNzNhYjdiZGViNzZmZjQ4YjJjYTA5OTYxNmVkYmU3
MWM0MjYwHhcNMjQwMTAxMjIzMTMyWhcNMjUwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
EygxZDgwMjVjMzhhMGI4ZjI0NmI0ZmVkNzM1ZTdkZDFjZDkxYjg2MTA4MIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArt9NMgA/zvx6ivPxOZgvtL4L+J9d
8yMisxdQOsCKSyTrdshVnhvz6K5ii9xBeXMTjYuRQH0jnH/oozKoGGqggbe97XeW
EeF3u8/VK9rDlNhqlwyUtnDK+57QuAEKtUW50yh1QvivTEhvCWroEDFCu/UqhxD7
nTph0H8924KPybQmKsrRnnEhI0m+GCnVmrNTYkGZK52YcUkojnHcFAnXfofiLfDF
irT111TOMQ7wozuEG3W/VLGeF4hzA/8+um0wuFD1Bxx5c38cLE6ApEdtYVfMSW1z
XXjiYNclKhRwdSI5sqFzUnigi4uTBnTyZPypxQzG7aNl5MQhL+gJ+m6LKQIDAQAB
o4ICKDCCAiQwHQYDVR0OBBYEFB2AJcOKC48ka0/tc1590c2RuGEIMB8GA1UdIwQY
MBaAFIHItzq3vet2/0iyygmWFu2+ccQmMA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvZ2NpM09yZTk2M2JfU0xMS0NaWVc3YjV4eENZLmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC85OC8yMDc5MzQtOWVkYy00YTg5LTgyMGUt
ZDg0ODhiM2FiNDJmLzEvSFlBbHc0b0xqeVJyVC0xelhuM1J6Wkc0WVFnLnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC85OC8yMDc5MzQtOWVkYy00YTg5LTgyMGUtZDg0ODhiM2FiNDJm
LzEvZ2NpM09yZTk2M2JfU0xMS0NaWVc3YjV4eENZLmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMD4GCCsGAQUFBwEHAQH/BC8wLTArBAIAAjAlAwUDKgncAAMF
ACoKH0EwDgMFACoKH0MDBQEqCh9EAwUDKgraQDANBgkqhkiG9w0BAQsFAAOCAQEA
bMWDH8MDoMuV2bRxdGqyDGoXC4bNFNUE8QtprhL0Go8cB5eCwqcySXGMo/Fbc8yx
kBvZ42H8un+yCJmOAz+KDegmyk4XvNbISrXNvHtuS5E0bZ8dzrfdrJjbonVXoixz
NbrZXly+5RATbimbwHIiQxj0r6GAb2JFEtXAgUCC9/0CKi/6Upt7+adFhhTuqx41
K5pOleirimwLwDBOTXoS3D/xJoxf0vGYT8ka70ih0SLEEfTh4qaBSIOofoJA6C+h
shpndMeKXJ7WH6D58UxhNhtdTbnLxR3wPl0OLfIrjYc0N8TQ/zACbKUjZ9Z0wqr6
naQKkmplzKgFc3vWcQ8mQg==
-----END CERTIFICATE-----