Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/cf/a8947f-e52c-4de1-bade-70c0a506d797/1/wfqODeRH8Q-7IUYK09E7TTlhhXM.roa
File:                     wfqODeRH8Q-7IUYK09E7TTlhhXM.roa (raw, json)
Hash identifier:          S4IPahmnQOkePhZlJSYDUjSGQ0bSSchvtO3bUySeUB0=
Subject key identifier:   C1:FA:8E:0D:E4:47:F1:0F:BB:21:46:0A:D3:D1:3B:4D:39:61:85:73
Certificate issuer:       /CN=02b980c10d7110f91fff9e0eceb639d9e75b35e2
Certificate serial:       0373E1E5
Authority key identifier: 02:B9:80:C1:0D:71:10:F9:1F:FF:9E:0E:CE:B6:39:D9:E7:5B:35:E2
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/ArmAwQ1xEPkf_54OzrY52edbNeI.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/cf/a8947f-e52c-4de1-bade-70c0a506d797/1/wfqODeRH8Q-7IUYK09E7TTlhhXM.roa
Signing time:             Tue 17 May 2022 21:14:29 +0000
ROA not before:           Tue 17 May 2022 21:14:29 +0000
ROA not after:            Sat 01 Jul 2023 00:00:00 +0000
asID:                     29676
IP address blocks:        109.224.192.0/18 maxlen: 18

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 57926117 (0x373e1e5)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=02b980c10d7110f91fff9e0eceb639d9e75b35e2
        Validity
            Not Before: May 17 21:14:29 2022 GMT
            Not After : Jul  1 00:00:00 2023 GMT
        Subject: CN=c1fa8e0de447f10fbb21460ad3d13b4d39618573
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:a8:70:e6:af:c2:e6:8f:f0:29:1c:4d:a1:e0:f3:
                    ed:e4:ff:27:3f:f1:2d:0b:65:58:c5:b2:f1:4f:33:
                    1a:16:3a:4c:16:7b:ed:5a:3f:34:ea:7a:eb:59:60:
                    a8:bf:2a:86:e8:7f:46:90:67:80:4a:aa:d2:9b:97:
                    41:2a:f9:6e:fd:a6:17:0f:af:e9:de:2e:62:a0:70:
                    ed:ba:18:51:7d:b6:1e:05:02:f2:eb:48:ed:51:dd:
                    fd:ad:ca:e8:b0:a0:36:9a:42:48:f9:eb:c8:6d:3a:
                    92:6e:f3:3b:77:04:e1:cc:76:17:3d:09:be:02:eb:
                    d3:1b:24:19:7e:16:2a:f7:ad:96:dd:97:6a:b9:92:
                    f6:8a:2c:f4:19:10:60:d7:af:4f:83:93:91:5b:f4:
                    24:e7:96:e7:93:03:93:ae:0f:6c:cb:4e:26:21:f3:
                    3b:fc:2b:53:03:f3:32:63:8a:3c:0e:5a:af:b1:52:
                    97:be:ba:52:15:81:b6:e3:81:23:53:1a:78:e7:bf:
                    37:22:87:6c:96:ec:7a:0c:64:94:ab:28:46:cb:8e:
                    ef:ad:e0:01:e1:bd:d7:33:fb:2d:12:3a:ae:55:37:
                    29:68:be:87:ec:96:c4:b7:dc:4f:6b:3a:a0:24:d5:
                    4d:81:16:30:97:45:d3:2f:a1:35:f4:55:d5:b3:7c:
                    13:1f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                C1:FA:8E:0D:E4:47:F1:0F:BB:21:46:0A:D3:D1:3B:4D:39:61:85:73
            X509v3 Authority Key Identifier:
                keyid:02:B9:80:C1:0D:71:10:F9:1F:FF:9E:0E:CE:B6:39:D9:E7:5B:35:E2

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/ArmAwQ1xEPkf_54OzrY52edbNeI.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/cf/a8947f-e52c-4de1-bade-70c0a506d797/1/wfqODeRH8Q-7IUYK09E7TTlhhXM.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/cf/a8947f-e52c-4de1-bade-70c0a506d797/1/ArmAwQ1xEPkf_54OzrY52edbNeI.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv4:
                  109.224.192.0/18

    Signature Algorithm: sha256WithRSAEncryption
         c7:86:c3:db:5a:2a:92:84:af:f7:0a:f8:f0:7b:e1:14:28:80:
         3d:47:3f:08:c0:8a:de:9c:40:9b:a4:60:90:58:47:ed:11:38:
         a0:a3:0c:4b:43:db:a4:84:56:f8:4b:2b:4a:35:6e:a9:ca:64:
         f2:e7:6b:7d:bb:29:37:d0:19:d0:25:65:7c:f0:ff:61:51:65:
         a1:01:ef:60:5b:56:74:78:49:e2:f4:0a:0c:ce:cc:f5:aa:81:
         88:3b:1b:56:62:20:b6:40:9d:02:fa:58:6a:67:49:74:66:32:
         2f:7a:ab:47:36:be:4c:76:d9:44:ad:20:0d:a9:e4:3b:00:fd:
         96:fd:ec:fd:18:16:c1:16:8a:5d:81:63:05:b1:9e:f0:d6:4e:
         18:a5:09:a1:85:09:08:e0:83:33:67:23:04:6c:5b:9f:6c:2b:
         bc:02:42:ff:ec:7e:3c:00:a5:65:63:8d:08:c6:cc:24:16:d4:
         da:9b:33:63:78:de:75:d0:de:96:4c:57:8c:ab:cb:41:6c:e7:
         d5:ca:55:47:dd:85:c7:d1:59:1a:96:58:69:0e:9c:25:2d:73:
         a7:16:a8:53:b2:e9:7e:99:9e:a9:f5:8f:32:7f:6a:d3:b9:55:
         f7:6a:a5:77:45:92:62:a3:a0:5d:d2:a3:20:c2:f1:77:ee:57:
         16:2b:3a:fd
-----BEGIN CERTIFICATE-----
MIIE7zCCA9egAwIBAgIEA3Ph5TANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDEygw
MmI5ODBjMTBkNzExMGY5MWZmZjllMGVjZWI2MzlkOWU3NWIzNWUyMB4XDTIyMDUx
NzIxMTQyOVoXDTIzMDcwMTAwMDAwMFowMzExMC8GA1UEAxMoYzFmYThlMGRlNDQ3
ZjEwZmJiMjE0NjBhZDNkMTNiNGQzOTYxODU3MzCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBAKhw5q/C5o/wKRxNoeDz7eT/Jz/xLQtlWMWy8U8zGhY6TBZ7
7Vo/NOp661lgqL8qhuh/RpBngEqq0puXQSr5bv2mFw+v6d4uYqBw7boYUX22HgUC
8utI7VHd/a3K6LCgNppCSPnryG06km7zO3cE4cx2Fz0JvgLr0xskGX4WKvetlt2X
armS9oos9BkQYNevT4OTkVv0JOeW55MDk64PbMtOJiHzO/wrUwPzMmOKPA5ar7FS
l766UhWBtuOBI1MaeOe/NyKHbJbsegxklKsoRsuO763gAeG91zP7LRI6rlU3KWi+
h+yWxLfcT2s6oCTVTYEWMJdF0y+hNfRV1bN8Ex8CAwEAAaOCAgkwggIFMB0GA1Ud
DgQWBBTB+o4N5EfxD7shRgrT0TtNOWGFczAfBgNVHSMEGDAWgBQCuYDBDXEQ+R//
ng7OtjnZ51s14jAOBgNVHQ8BAf8EBAMCB4AwZAYIKwYBBQUHAQEEWDBWMFQGCCsG
AQUFBzAChkhyc3luYzovL3Jwa2kucmlwZS5uZXQvcmVwb3NpdG9yeS9ERUZBVUxU
L0FybUF3UTF4RVBrZl81NE96clk1MmVkYk5lSS5jZXIwgY0GCCsGAQUFBwELBIGA
MH4wfAYIKwYBBQUHMAuGcHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBvc2l0b3J5
L0RFRkFVTFQvY2YvYTg5NDdmLWU1MmMtNGRlMS1iYWRlLTcwYzBhNTA2ZDc5Ny8x
L3dmcU9EZVJIOFEtN0lVWUswOUU3VFRsaGhYTS5yb2EwgYEGA1UdHwR6MHgwdqB0
oHKGcHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBvc2l0b3J5L0RFRkFVTFQvY2Yv
YTg5NDdmLWU1MmMtNGRlMS1iYWRlLTcwYzBhNTA2ZDc5Ny8xL0FybUF3UTF4RVBr
Zl81NE96clk1MmVkYk5lSS5jcmwwGAYDVR0gAQH/BA4wDDAKBggrBgEFBQcOAjAf
BggrBgEFBQcBBwEB/wQQMA4wDAQCAAEwBgMEBm3gwDANBgkqhkiG9w0BAQsFAAOC
AQEAx4bD21oqkoSv9wr48HvhFCiAPUc/CMCK3pxAm6RgkFhH7RE4oKMMS0PbpIRW
+EsrSjVuqcpk8udrfbspN9AZ0CVlfPD/YVFloQHvYFtWdHhJ4vQKDM7M9aqBiDsb
VmIgtkCdAvpYamdJdGYyL3qrRza+THbZRK0gDankOwD9lv3s/RgWwRaKXYFjBbGe
8NZOGKUJoYUJCOCDM2cjBGxbn2wrvAJC/+x+PAClZWONCMbMJBbU2pszY3jeddDe
lkxXjKvLQWzn1cpVR92Fx9FZGpZYaQ6cJS1zpxaoU7LpfpmeqfWPMn9q07lV92ql
d0WSYqOgXdKjIMLxd+5XFis6/Q==
-----END CERTIFICATE-----