Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/c8/d4a89c-54b2-445b-bb7c-609a48b2b14d/1/Ha7YkOTTXlwsT55lXyHcEDOlr3o.roa
File:                     Ha7YkOTTXlwsT55lXyHcEDOlr3o.roa (raw, json)
Hash identifier:          KeS1pIey9JDRT67r6uHZ3IZhXSFlUtCvtfdINcv9T90=
Subject key identifier:   1D:AE:D8:90:E4:D3:5E:5C:2C:4F:9E:65:5F:21:DC:10:33:A5:AF:7A
Certificate issuer:       /CN=387d6df7eb7542e0333aeedd14adff8f51f8cbd8
Certificate serial:       09B8D17A
Authority key identifier: 38:7D:6D:F7:EB:75:42:E0:33:3A:EE:DD:14:AD:FF:8F:51:F8:CB:D8
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/OH1t9-t1QuAzOu7dFK3_j1H4y9g.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/c8/d4a89c-54b2-445b-bb7c-609a48b2b14d/1/Ha7YkOTTXlwsT55lXyHcEDOlr3o.roa
Signing time:             Sat 01 Jan 2022 12:05:42 +0000
ROA not before:           Sat 01 Jan 2022 12:05:42 +0000
ROA not after:            Sat 01 Jul 2023 00:00:00 +0000
asID:                     51658
IP address blocks:        185.202.133.0/24 maxlen: 24
                          2a0a:d6c0:1::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 163107194 (0x9b8d17a)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=387d6df7eb7542e0333aeedd14adff8f51f8cbd8
        Validity
            Not Before: Jan  1 12:05:42 2022 GMT
            Not After : Jul  1 00:00:00 2023 GMT
        Subject: CN=1daed890e4d35e5c2c4f9e655f21dc1033a5af7a
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ae:18:bd:1c:3e:e4:48:ca:d1:e5:4a:52:2d:8d:
                    98:cf:f1:63:ae:cf:42:b1:10:7b:0f:2b:0c:88:09:
                    97:f4:e7:28:97:49:4b:8e:f2:33:64:24:11:de:54:
                    a3:15:a7:91:25:b1:5e:8f:00:f0:7e:a8:01:18:bf:
                    6d:2d:fd:3c:9a:a9:8a:5a:90:ce:cc:1a:e2:92:58:
                    9c:46:54:3c:e4:04:0e:3f:c0:8f:0f:ac:68:60:8f:
                    0b:cd:7b:dc:ba:ef:2f:96:95:41:5c:e3:0b:e6:e1:
                    51:3f:db:d5:5b:dc:a6:46:0a:dc:6e:af:51:04:97:
                    d5:18:29:e2:c3:9d:a2:4a:59:6c:72:0e:3e:06:6a:
                    71:59:4e:8c:17:3e:c7:04:9c:15:d9:f7:98:23:44:
                    66:b3:a5:45:33:c9:eb:f1:f3:ad:1c:2f:c0:00:07:
                    ad:80:4a:4e:1b:4e:9d:91:c5:08:4f:4a:17:6c:39:
                    7e:2f:f2:9f:16:e7:48:48:00:12:e6:41:49:a4:eb:
                    01:c8:c3:9a:8c:30:50:bf:e9:d5:5a:84:4f:c9:0a:
                    4f:d3:11:5e:3d:30:af:eb:1a:b2:ef:53:1f:23:86:
                    ed:6f:b1:4d:88:8d:fc:6e:f6:2f:5b:18:47:f2:79:
                    48:10:e6:a2:dc:47:52:fd:30:11:d7:28:52:77:7c:
                    4c:35
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                1D:AE:D8:90:E4:D3:5E:5C:2C:4F:9E:65:5F:21:DC:10:33:A5:AF:7A
            X509v3 Authority Key Identifier:
                keyid:38:7D:6D:F7:EB:75:42:E0:33:3A:EE:DD:14:AD:FF:8F:51:F8:CB:D8

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/OH1t9-t1QuAzOu7dFK3_j1H4y9g.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/c8/d4a89c-54b2-445b-bb7c-609a48b2b14d/1/Ha7YkOTTXlwsT55lXyHcEDOlr3o.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/c8/d4a89c-54b2-445b-bb7c-609a48b2b14d/1/OH1t9-t1QuAzOu7dFK3_j1H4y9g.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv4:
                  185.202.133.0/24
                IPv6:
                  2a0a:d6c0:1::/48

    Signature Algorithm: sha256WithRSAEncryption
         ac:78:ab:51:7a:aa:ac:60:3c:14:a8:35:00:5d:a8:cd:03:6c:
         3d:6c:10:62:eb:83:f0:dd:bd:40:c9:a4:5a:fe:b3:7b:15:74:
         0e:17:82:68:c3:5f:7b:26:ff:50:48:f3:ef:c7:44:0a:60:82:
         77:ce:6a:b9:2e:ca:80:bd:cb:f5:1c:b7:5a:30:96:cf:90:de:
         d6:7c:f5:b9:a0:38:bb:b1:f7:f6:1f:67:5a:77:02:d3:89:77:
         9c:8e:86:72:91:62:40:9b:9a:9f:66:9b:4b:27:2f:bd:2c:33:
         10:32:87:77:ce:3a:8c:0f:31:e5:e5:93:7c:82:69:b6:f0:28:
         f3:6f:87:b2:b6:3c:3e:3d:10:9e:04:20:a9:2b:f8:6e:37:f7:
         e5:7f:ab:88:21:c1:e8:37:6f:f2:79:e8:0c:83:d8:18:1c:0a:
         ca:7b:d2:18:3a:c4:ce:ea:c7:10:9d:2d:8e:ef:2c:20:26:aa:
         72:93:d8:9f:32:a3:69:d0:c5:65:87:38:e9:03:b4:d0:ce:83:
         e7:2c:ad:e0:b2:c0:92:9d:64:75:da:d5:dd:b4:de:54:e9:d2:
         2e:c7:0d:d8:6c:e7:6a:15:43:77:d9:d0:4f:58:ec:07:cf:e6:
         96:d1:1f:20:55:e7:29:a2:c2:23:02:26:15:81:1c:19:eb:2a:
         8e:49:c0:92
-----BEGIN CERTIFICATE-----
MIIFADCCA+igAwIBAgIECbjRejANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygz
ODdkNmRmN2ViNzU0MmUwMzMzYWVlZGQxNGFkZmY4ZjUxZjhjYmQ4MB4XDTIyMDEw
MTEyMDU0MloXDTIzMDcwMTAwMDAwMFowMzExMC8GA1UEAxMoMWRhZWQ4OTBlNGQz
NWU1YzJjNGY5ZTY1NWYyMWRjMTAzM2E1YWY3YTCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBAK4YvRw+5EjK0eVKUi2NmM/xY67PQrEQew8rDIgJl/TnKJdJ
S47yM2QkEd5UoxWnkSWxXo8A8H6oARi/bS39PJqpilqQzswa4pJYnEZUPOQEDj/A
jw+saGCPC8173LrvL5aVQVzjC+bhUT/b1VvcpkYK3G6vUQSX1Rgp4sOdokpZbHIO
PgZqcVlOjBc+xwScFdn3mCNEZrOlRTPJ6/HzrRwvwAAHrYBKThtOnZHFCE9KF2w5
fi/ynxbnSEgAEuZBSaTrAcjDmowwUL/p1VqET8kKT9MRXj0wr+sasu9THyOG7W+x
TYiN/G72L1sYR/J5SBDmotxHUv0wEdcoUnd8TDUCAwEAAaOCAhowggIWMB0GA1Ud
DgQWBBQdrtiQ5NNeXCxPnmVfIdwQM6WvejAfBgNVHSMEGDAWgBQ4fW3363VC4DM6
7t0Urf+PUfjL2DAOBgNVHQ8BAf8EBAMCB4AwZAYIKwYBBQUHAQEEWDBWMFQGCCsG
AQUFBzAChkhyc3luYzovL3Jwa2kucmlwZS5uZXQvcmVwb3NpdG9yeS9ERUZBVUxU
L09IMXQ5LXQxUXVBek91N2RGSzNfajFINHk5Zy5jZXIwgY0GCCsGAQUFBwELBIGA
MH4wfAYIKwYBBQUHMAuGcHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBvc2l0b3J5
L0RFRkFVTFQvYzgvZDRhODljLTU0YjItNDQ1Yi1iYjdjLTYwOWE0OGIyYjE0ZC8x
L0hhN1lrT1RUWGx3c1Q1NWxYeUhjRURPbHIzby5yb2EwgYEGA1UdHwR6MHgwdqB0
oHKGcHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBvc2l0b3J5L0RFRkFVTFQvYzgv
ZDRhODljLTU0YjItNDQ1Yi1iYjdjLTYwOWE0OGIyYjE0ZC8xL09IMXQ5LXQxUXVB
ek91N2RGSzNfajFINHk5Zy5jcmwwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjAw
BggrBgEFBQcBBwEB/wQhMB8wDAQCAAEwBgMEALnKhTAPBAIAAjAJAwcAKgrWwAAB
MA0GCSqGSIb3DQEBCwUAA4IBAQCseKtReqqsYDwUqDUAXajNA2w9bBBi64Pw3b1A
yaRa/rN7FXQOF4Jow197Jv9QSPPvx0QKYIJ3zmq5LsqAvcv1HLdaMJbPkN7WfPW5
oDi7sff2H2dadwLTiXecjoZykWJAm5qfZptLJy+9LDMQMod3zjqMDzHl5ZN8gmm2
8Cjzb4eytjw+PRCeBCCpK/huN/flf6uIIcHoN2/yeegMg9gYHArKe9IYOsTO6scQ
nS2O7ywgJqpyk9ifMqNp0MVlhzjpA7TQzoPnLK3gssCSnWR12tXdtN5U6dIuxw3Y
bOdqFUN32dBPWOwHz+aW0R8gVecposIjAiYVgRwZ6yqOScCS
-----END CERTIFICATE-----