Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/e7/8976ed-da0a-49a5-a751-a871ecc212a6/1/2ZwPnymS5PpRknavskwOXXVI24Q.roa
File:                     2ZwPnymS5PpRknavskwOXXVI24Q.roa (raw, json)
Hash identifier:          myhyIGjRuL9t1q8GQUpIE48XN2ry3fw2nxRT2+PeY54=
Subject key identifier:   D9:9C:0F:9F:29:92:E4:FA:51:92:76:AF:B2:4C:0E:5D:75:48:DB:84
Certificate issuer:       /CN=e8403b5e45cd58be5f6c5d33fa565ab49223e3db
Certificate serial:       018572FA5D1899BE67D30A54F6A331096519
Authority key identifier: E8:40:3B:5E:45:CD:58:BE:5F:6C:5D:33:FA:56:5A:B4:92:23:E3:DB
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/6EA7XkXNWL5fbF0z-lZatJIj49s.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/e7/8976ed-da0a-49a5-a751-a871ecc212a6/1/2ZwPnymS5PpRknavskwOXXVI24Q.roa
Signing time:             Mon 02 Jan 2023 14:54:48 +0000
ROA not before:           Mon 02 Jan 2023 14:54:48 +0000
ROA not after:            Mon 01 Jul 2024 00:00:00 +0000
asID:                     49538
IP address blocks:        213.192.236.0/23 maxlen: 24

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:85:72:fa:5d:18:99:be:67:d3:0a:54:f6:a3:31:09:65:19
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=e8403b5e45cd58be5f6c5d33fa565ab49223e3db
        Validity
            Not Before: Jan  2 14:54:48 2023 GMT
            Not After : Jul  1 00:00:00 2024 GMT
        Subject: CN=d99c0f9f2992e4fa519276afb24c0e5d7548db84
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:81:bd:27:be:7f:52:5d:3a:82:91:d9:ef:16:01:
                    5a:c4:88:eb:40:f7:d7:03:86:87:00:4f:1f:92:7b:
                    49:66:14:a2:c2:41:f9:83:e1:f3:3a:29:0a:0a:26:
                    84:f0:9d:2f:58:d6:23:53:65:1b:82:03:18:6b:ee:
                    17:89:0a:1f:6a:2f:df:3f:d2:77:4b:66:ee:1a:31:
                    7c:14:6a:b0:b8:db:7c:08:29:24:60:97:87:8d:54:
                    64:3e:a4:04:68:85:1d:88:5d:8c:be:f7:c3:0a:ac:
                    4d:7e:5c:32:f6:02:0b:f4:45:f8:5a:27:55:1d:94:
                    b5:25:7a:22:91:90:c0:af:95:b7:a6:d9:1b:1d:26:
                    14:8f:8f:15:b4:57:9d:a1:f5:b6:3d:7a:32:6c:4d:
                    cc:fa:ed:56:8b:af:85:91:0f:e5:24:6a:45:6b:81:
                    41:a3:f8:f9:c8:83:81:75:53:33:23:c7:cb:09:7b:
                    32:f7:2a:28:43:fb:72:3c:f0:9c:65:dc:69:7e:83:
                    36:a6:8e:cd:d2:9e:6c:7a:2a:5f:e4:7b:24:83:fd:
                    d7:b3:ea:72:7b:75:4f:83:bb:f6:39:d9:cb:0b:b6:
                    65:56:c5:07:51:e4:e1:6a:57:05:f8:ff:3b:7b:d0:
                    d9:67:c6:c1:f8:c7:7e:44:97:63:57:9f:b0:7b:d2:
                    50:0f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                D9:9C:0F:9F:29:92:E4:FA:51:92:76:AF:B2:4C:0E:5D:75:48:DB:84
            X509v3 Authority Key Identifier:
                keyid:E8:40:3B:5E:45:CD:58:BE:5F:6C:5D:33:FA:56:5A:B4:92:23:E3:DB

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/6EA7XkXNWL5fbF0z-lZatJIj49s.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/e7/8976ed-da0a-49a5-a751-a871ecc212a6/1/2ZwPnymS5PpRknavskwOXXVI24Q.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/e7/8976ed-da0a-49a5-a751-a871ecc212a6/1/6EA7XkXNWL5fbF0z-lZatJIj49s.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv4:
                  213.192.236.0/23

    Signature Algorithm: sha256WithRSAEncryption
         33:32:44:ca:78:98:4c:bc:97:37:f1:9d:51:f5:50:02:86:c5:
         95:ff:c6:ee:21:78:95:4b:ca:49:ae:31:4d:14:5c:66:5b:97:
         b9:cb:c3:11:92:d9:13:16:e1:3f:d6:16:e3:a0:81:53:a0:3b:
         67:2b:92:d8:57:45:49:a9:89:58:ac:10:63:17:ae:bf:fe:93:
         c6:d8:d2:52:a5:14:39:c5:17:bf:33:97:1b:aa:63:5f:99:74:
         d3:68:d3:41:09:ae:51:29:5e:d8:ce:35:e0:2a:a0:dd:9c:2c:
         73:f5:f6:80:65:e9:f9:60:59:fd:bb:08:d6:6b:2c:e1:67:72:
         0f:d7:77:6d:69:65:e3:b8:b0:b1:14:56:0f:16:d4:94:1c:ea:
         8e:84:bc:a5:74:23:69:1c:77:02:22:63:99:db:b5:fd:cb:b3:
         b0:39:ae:9a:17:b3:9b:3e:4a:b7:ef:a3:7f:71:d7:b6:33:63:
         89:91:7d:9e:1f:0d:cb:08:cd:84:69:6b:8a:19:08:c9:1f:3c:
         00:b1:30:b3:16:91:86:c7:c5:7e:c1:f3:fd:e6:77:10:9f:72:
         1c:46:51:10:db:63:8b:c9:6e:81:8a:5c:6d:92:16:b0:cd:4b:
         00:c3:dd:6c:cc:bf:01:08:e1:f6:25:66:26:13:7d:c9:a7:4c:
         56:eb:05:f7
-----BEGIN CERTIFICATE-----
MIIE/TCCA+WgAwIBAgISAYVy+l0Ymb5n0wpU9qMxCWUZMA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKGU4NDAzYjVlNDVjZDU4YmU1ZjZjNWQzM2ZhNTY1YWI0OTIy
M2UzZGIwHhcNMjMwMTAyMTQ1NDQ4WhcNMjQwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
EyhkOTljMGY5ZjI5OTJlNGZhNTE5Mjc2YWZiMjRjMGU1ZDc1NDhkYjg0MIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgb0nvn9SXTqCkdnvFgFaxIjrQPfX
A4aHAE8fkntJZhSiwkH5g+HzOikKCiaE8J0vWNYjU2UbggMYa+4XiQofai/fP9J3
S2buGjF8FGqwuNt8CCkkYJeHjVRkPqQEaIUdiF2MvvfDCqxNflwy9gIL9EX4WidV
HZS1JXoikZDAr5W3ptkbHSYUj48VtFedofW2PXoybE3M+u1Wi6+FkQ/lJGpFa4FB
o/j5yIOBdVMzI8fLCXsy9yooQ/tyPPCcZdxpfoM2po7N0p5seipf5Hskg/3Xs+py
e3VPg7v2OdnLC7ZlVsUHUeThalcF+P87e9DZZ8bB+Md+RJdjV5+we9JQDwIDAQAB
o4ICCTCCAgUwHQYDVR0OBBYEFNmcD58pkuT6UZJ2r7JMDl11SNuEMB8GA1UdIwQY
MBaAFOhAO15FzVi+X2xdM/pWWrSSI+PbMA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvNkVBN1hrWE5XTDVmYkYwei1sWmF0SklqNDlzLmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC9lNy84OTc2ZWQtZGEwYS00OWE1LWE3NTEt
YTg3MWVjYzIxMmE2LzEvMlp3UG55bVM1UHBSa25hdnNrd09YWFZJMjRRLnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC9lNy84OTc2ZWQtZGEwYS00OWE1LWE3NTEtYTg3MWVjYzIxMmE2
LzEvNkVBN1hrWE5XTDVmYkYwei1sWmF0SklqNDlzLmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMB8GCCsGAQUFBwEHAQH/BBAwDjAMBAIAATAGAwQB1cDsMA0G
CSqGSIb3DQEBCwUAA4IBAQAzMkTKeJhMvJc38Z1R9VAChsWV/8buIXiVS8pJrjFN
FFxmW5e5y8MRktkTFuE/1hbjoIFToDtnK5LYV0VJqYlYrBBjF66//pPG2NJSpRQ5
xRe/M5cbqmNfmXTTaNNBCa5RKV7YzjXgKqDdnCxz9faAZen5YFn9uwjWayzhZ3IP
13dtaWXjuLCxFFYPFtSUHOqOhLyldCNpHHcCImOZ27X9y7OwOa6aF7ObPkq376N/
cde2M2OJkX2eHw3LCM2EaWuKGQjJHzwAsTCzFpGGx8V+wfP95ncQn3IcRlEQ22OL
yW6BilxtkhawzUsAw91szL8BCOH2JWYmE33Jp0xW6wX3
-----END CERTIFICATE-----