Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/ce/5b21e3-3944-4ce6-aaf5-c0ba2f3fc72a/1/CqmYwnrTRD3vDawXL3egQK_PG9c.roa
File:                     CqmYwnrTRD3vDawXL3egQK_PG9c.roa (raw, json)
Hash identifier:          6vU+2oe6HC12ht5UrKhOkLcSPDsgQMa+IDgIdxD6dZY=
Subject key identifier:   0A:A9:98:C2:7A:D3:44:3D:EF:0D:AC:17:2F:77:A0:40:AF:CF:1B:D7
Certificate issuer:       /CN=5776d9a0b55bd495a1be3c5c03fa251d3de8b8c5
Certificate serial:       018CC6B85EE061CB498B775A3D8EFA9AF459
Authority key identifier: 57:76:D9:A0:B5:5B:D4:95:A1:BE:3C:5C:03:FA:25:1D:3D:E8:B8:C5
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/V3bZoLVb1JWhvjxcA_olHT3ouMU.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/ce/5b21e3-3944-4ce6-aaf5-c0ba2f3fc72a/1/CqmYwnrTRD3vDawXL3egQK_PG9c.roa
Signing time:             Mon 01 Jan 2024 20:30:20 +0000
ROA not before:           Mon 01 Jan 2024 20:30:20 +0000
ROA not after:            Tue 01 Jul 2025 00:00:00 +0000
asID:                     47753
IP address blocks:        185.249.254.0/24 maxlen: 24
                          2a10:a647::/32 maxlen: 32
                          2a10:a641::/40 maxlen: 40

Validation:               OK
Signature path:           rsync://rpki.ripe.net/repository/DEFAULT/ce/5b21e3-3944-4ce6-aaf5-c0ba2f3fc72a/1/V3bZoLVb1JWhvjxcA_olHT3ouMU.crl
                          rsync://rpki.ripe.net/repository/DEFAULT/ce/5b21e3-3944-4ce6-aaf5-c0ba2f3fc72a/1/V3bZoLVb1JWhvjxcA_olHT3ouMU.mft
                          rsync://rpki.ripe.net/repository/DEFAULT/V3bZoLVb1JWhvjxcA_olHT3ouMU.cer
                          rsync://rpki.ripe.net/repository/DEFAULT/KpSo3VVK5wEHIJnHC2QHVV3d5mk.crl
                          rsync://rpki.ripe.net/repository/DEFAULT/KpSo3VVK5wEHIJnHC2QHVV3d5mk.mft
                          rsync://rpki.ripe.net/repository/aca/KpSo3VVK5wEHIJnHC2QHVV3d5mk.cer
                          rsync://rpki.ripe.net/repository/aca/7DNNDzoYvgAht7joQih2Qayxcxo.crl
                          rsync://rpki.ripe.net/repository/aca/7DNNDzoYvgAht7joQih2Qayxcxo.mft
                          rsync://rpki.ripe.net/repository/ec334d0f3a18be0021b7b8e842287641acb1731a.cer
                          rsync://rpki.ripe.net/repository/ripe-ncc-ta.crl
                          rsync://rpki.ripe.net/repository/ripe-ncc-ta.mft
                          rsync://rpki.ripe.net/ta/ripe-ncc-ta.cer
Signature path expires:   Sat 23 Nov 2024 07:02:18 +0000

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:8c:c6:b8:5e:e0:61:cb:49:8b:77:5a:3d:8e:fa:9a:f4:59
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=5776d9a0b55bd495a1be3c5c03fa251d3de8b8c5
        Validity
            Not Before: Jan  1 20:30:20 2024 GMT
            Not After : Jul  1 00:00:00 2025 GMT
        Subject: CN=0aa998c27ad3443def0dac172f77a040afcf1bd7
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:d4:e8:01:c2:42:a7:cc:6a:e6:2a:04:d9:65:2a:
                    ec:09:1c:62:79:87:ab:d4:d1:cf:2c:fa:a3:51:f8:
                    21:b4:5e:a8:19:4c:21:ae:15:0d:06:1b:31:ed:03:
                    1e:95:3d:2f:61:23:75:a7:27:8e:fa:d9:53:64:27:
                    0d:fe:ef:71:b5:07:7c:85:c6:b4:ec:35:49:93:b2:
                    3b:57:01:88:97:9f:80:aa:8d:59:ef:77:56:69:ac:
                    08:8c:75:43:de:22:b2:43:48:fe:9b:27:82:5b:d4:
                    89:7f:5b:88:32:50:44:e1:a8:99:4c:d1:f9:15:56:
                    d1:f5:07:03:d5:db:b3:88:9b:b2:8a:ca:00:a3:e9:
                    1f:d9:07:f0:a2:d6:c4:56:40:79:64:b0:23:8e:3d:
                    e8:4c:a9:3c:df:66:42:95:e2:50:54:da:6f:b3:81:
                    10:c2:4a:d4:b4:6f:bf:59:f9:87:c2:e4:e9:07:9b:
                    44:a6:9f:58:7c:3e:91:aa:98:b5:c4:51:01:60:c5:
                    49:43:6c:88:4d:0e:88:18:37:f5:d6:c3:87:c9:40:
                    7e:23:96:7d:db:b5:d3:7d:6c:47:21:9f:61:b8:15:
                    55:9d:a5:5f:cc:33:84:04:e1:86:5d:f1:75:47:07:
                    72:8c:ff:0c:52:cf:85:0b:02:3b:02:e1:d5:33:38:
                    7c:b9
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                0A:A9:98:C2:7A:D3:44:3D:EF:0D:AC:17:2F:77:A0:40:AF:CF:1B:D7
            X509v3 Authority Key Identifier:
                keyid:57:76:D9:A0:B5:5B:D4:95:A1:BE:3C:5C:03:FA:25:1D:3D:E8:B8:C5

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/V3bZoLVb1JWhvjxcA_olHT3ouMU.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/ce/5b21e3-3944-4ce6-aaf5-c0ba2f3fc72a/1/CqmYwnrTRD3vDawXL3egQK_PG9c.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/ce/5b21e3-3944-4ce6-aaf5-c0ba2f3fc72a/1/V3bZoLVb1JWhvjxcA_olHT3ouMU.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv4:
                  185.249.254.0/24
                IPv6:
                  2a10:a641::/40
                  2a10:a647::/32

    Signature Algorithm: sha256WithRSAEncryption
         7f:5b:66:e0:49:81:0d:ac:61:c7:c0:0f:e1:1b:c4:04:6c:73:
         73:7e:ef:c9:ab:7b:ba:d5:2f:f7:92:2f:12:d4:34:0e:66:61:
         23:58:b7:09:da:0f:1f:b5:1a:21:11:63:62:c7:f0:0c:4c:1f:
         ce:c9:65:15:23:45:b9:64:09:80:1c:c4:77:71:18:1b:ac:b3:
         2e:de:f9:12:a2:28:a8:fa:67:6f:80:36:71:42:58:6a:7b:55:
         de:79:d6:2e:a2:76:b3:1c:21:a5:34:1c:e0:59:c0:eb:aa:b3:
         18:ff:63:c4:e9:0c:c1:a5:1f:56:cb:24:b2:b9:50:c6:78:c6:
         31:a3:03:10:2b:a2:32:1f:79:53:3d:c4:8a:a7:c2:d4:48:26:
         77:5b:cf:a1:af:a6:6a:48:d8:12:b8:f2:34:d9:fe:87:dc:18:
         64:2f:67:25:81:f2:80:84:e6:74:e1:e1:4a:55:c7:70:9f:8d:
         e7:31:2d:8b:5f:72:58:44:0e:53:95:4d:87:16:f5:d0:e6:b5:
         b2:54:7b:40:ea:60:b8:91:e8:c1:a6:59:4b:b9:d0:6b:c3:07:
         03:15:14:8d:0d:96:1c:3f:27:c7:7b:68:1a:ef:3c:67:52:87:
         54:86:21:52:ef:f3:78:81:68:9d:e6:85:7e:1f:04:84:af:e9:
         7b:a5:15:a4
-----BEGIN CERTIFICATE-----
MIIFFDCCA/ygAwIBAgISAYzGuF7gYctJi3daPY76mvRZMA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKDU3NzZkOWEwYjU1YmQ0OTVhMWJlM2M1YzAzZmEyNTFkM2Rl
OGI4YzUwHhcNMjQwMTAxMjAzMDIwWhcNMjUwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
EygwYWE5OThjMjdhZDM0NDNkZWYwZGFjMTcyZjc3YTA0MGFmY2YxYmQ3MIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1OgBwkKnzGrmKgTZZSrsCRxieYer
1NHPLPqjUfghtF6oGUwhrhUNBhsx7QMelT0vYSN1pyeO+tlTZCcN/u9xtQd8hca0
7DVJk7I7VwGIl5+Aqo1Z73dWaawIjHVD3iKyQ0j+myeCW9SJf1uIMlBE4aiZTNH5
FVbR9QcD1duziJuyisoAo+kf2QfwotbEVkB5ZLAjjj3oTKk832ZCleJQVNpvs4EQ
wkrUtG+/WfmHwuTpB5tEpp9YfD6Rqpi1xFEBYMVJQ2yITQ6IGDf11sOHyUB+I5Z9
27XTfWxHIZ9huBVVnaVfzDOEBOGGXfF1RwdyjP8MUs+FCwI7AuHVMzh8uQIDAQAB
o4ICIDCCAhwwHQYDVR0OBBYEFAqpmMJ600Q97w2sFy93oECvzxvXMB8GA1UdIwQY
MBaAFFd22aC1W9SVob48XAP6JR096LjFMA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvVjNiWm9MVmIxSldodmp4Y0Ffb2xIVDNvdU1VLmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC9jZS81YjIxZTMtMzk0NC00Y2U2LWFhZjUt
YzBiYTJmM2ZjNzJhLzEvQ3FtWXduclRSRDN2RGF3WEwzZWdRS19QRzljLnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC9jZS81YjIxZTMtMzk0NC00Y2U2LWFhZjUtYzBiYTJmM2ZjNzJh
LzEvVjNiWm9MVmIxSldodmp4Y0Ffb2xIVDNvdU1VLmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMDYGCCsGAQUFBwEHAQH/BCcwJTAMBAIAATAGAwQAufn+MBUE
AgACMA8DBgAqEKZBAAMFACoQpkcwDQYJKoZIhvcNAQELBQADggEBAH9bZuBJgQ2s
YcfAD+EbxARsc3N+78mre7rVL/eSLxLUNA5mYSNYtwnaDx+1GiERY2LH8AxMH87J
ZRUjRblkCYAcxHdxGBussy7e+RKiKKj6Z2+ANnFCWGp7Vd551i6idrMcIaU0HOBZ
wOuqsxj/Y8TpDMGlH1bLJLK5UMZ4xjGjAxArojIfeVM9xIqnwtRIJndbz6GvpmpI
2BK48jTZ/ofcGGQvZyWB8oCE5nTh4UpVx3CfjecxLYtfclhEDlOVTYcW9dDmtbJU
e0DqYLiR6MGmWUu50GvDBwMVFI0Nlhw/J8d7aBrvPGdSh1SGIVLv83iBaJ3mhX4f
BISv6XulFaQ=
-----END CERTIFICATE-----