Route Origin Authorization

$ rpki-client -vvf rpki.apnic.net/member_repository/A919B06C/E9D62E74FEAE11E8910D4D66C4F9AE02/7BD51C0818B511EDB560256FC4F9AE02.roa
File:                     7BD51C0818B511EDB560256FC4F9AE02.roa (raw, json)
Hash identifier:          XJHH3njdSbw6QCkd8zVaIbkDkLpEEkoHRW1w2QXoEJ8=
Subject key identifier:   E2:B1:99:A9:C9:5C:19:94:E5:AB:26:DE:AD:96:12:5C:BF:80:A5:57
Certificate issuer:       /CN=A919B06C/serialNumber=C83493C0297CCB58D2837946D6063F14A7DEE986
Certificate serial:       0C86
Authority key identifier: C8:34:93:C0:29:7C:CB:58:D2:83:79:46:D6:06:3F:14:A7:DE:E9:86
Authority info access:    rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/yDSTwCl8y1jSg3lG1gY_FKfe6YY.cer
Subject info access:      rsync://rpki.apnic.net/member_repository/A919B06C/E9D62E74FEAE11E8910D4D66C4F9AE02/7BD51C0818B511EDB560256FC4F9AE02.roa
Signing time:             Wed 10 May 2023 18:57:56 +0000
ROA not before:           Wed 10 May 2023 18:57:56 +0000
ROA not after:            Wed 29 May 2024 00:00:00 +0000
asID:                     18230
IP address blocks:        59.152.0.0/20 maxlen: 20
                          59.152.0.0/24 maxlen: 24
                          59.152.1.0/24 maxlen: 24
                          59.152.2.0/24 maxlen: 24
                          59.152.4.0/24 maxlen: 24
                          59.152.5.0/24 maxlen: 24
                          59.152.6.0/24 maxlen: 24
                          59.152.7.0/24 maxlen: 24
                          59.152.8.0/24 maxlen: 24
                          59.152.9.0/24 maxlen: 24
                          59.152.10.0/24 maxlen: 24
                          59.152.11.0/24 maxlen: 24
                          59.152.12.0/24 maxlen: 24
                          59.152.13.0/24 maxlen: 24
                          59.152.15.0/24 maxlen: 24
                          2404:1b40::/32 maxlen: 32
                          2404:1b40::/48 maxlen: 48
                          2404:1b40:1::/48 maxlen: 48
                          2404:1b40:2::/48 maxlen: 48

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 3206 (0xc86)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=A919B06C/serialNumber=C83493C0297CCB58D2837946D6063F14A7DEE986
        Validity
            Not Before: May 10 18:57:56 2023 GMT
            Not After : May 29 00:00:00 2024 GMT
        Subject: CN=645be934-54cc
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:fc:ae:20:f3:ca:e5:ee:67:a7:98:4b:4d:17:ff:
                    b6:0c:b3:d5:9f:24:94:87:0a:b6:43:f4:ca:c7:46:
                    f1:06:d5:df:89:af:5f:6c:24:4e:f3:09:e3:93:b0:
                    98:ac:e6:22:b9:88:f2:ca:e8:92:b6:e7:47:44:f7:
                    95:a2:c0:ad:1a:5c:f3:e6:4a:a1:c4:4e:0d:53:72:
                    ba:a9:2c:3d:08:44:61:c5:e3:a9:87:fb:ca:ad:31:
                    cc:6d:54:f9:ea:ca:42:78:60:74:88:ee:d7:a4:cb:
                    bd:e4:4c:3e:9f:9d:47:d2:24:07:7e:5b:27:ed:f1:
                    36:16:c3:1c:09:bc:42:f0:9c:96:f8:5c:a8:ac:2a:
                    44:44:32:47:1f:3d:6f:a3:13:10:4f:e3:38:52:c1:
                    55:3f:78:8a:47:2d:67:f0:2a:2d:cc:a4:56:19:60:
                    67:95:20:df:d9:8d:77:b0:18:de:44:bb:86:22:a0:
                    17:b3:93:c6:90:e2:d3:bf:33:4b:3d:52:35:d7:06:
                    e9:f5:2e:6f:3c:34:2d:a1:b6:8c:f6:8b:bb:71:a7:
                    b6:23:55:34:ea:98:68:63:19:68:e1:78:a3:70:a0:
                    b1:08:d4:30:e7:cf:e0:a9:61:08:b2:c7:35:c6:7b:
                    53:30:71:e4:d7:56:71:b8:79:a9:e9:19:5e:07:31:
                    bd:0f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                E2:B1:99:A9:C9:5C:19:94:E5:AB:26:DE:AD:96:12:5C:BF:80:A5:57
            X509v3 Authority Key Identifier:
                keyid:C8:34:93:C0:29:7C:CB:58:D2:83:79:46:D6:06:3F:14:A7:DE:E9:86

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.apnic.net/member_repository/A919B06C/E9D62E74FEAE11E8910D4D66C4F9AE02/yDSTwCl8y1jSg3lG1gY_FKfe6YY.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/yDSTwCl8y1jSg3lG1gY_FKfe6YY.cer

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber
                  CPS: https://www.apnic.net/RPKI/CPS.pdf

            Subject Information Access:
                Signed Object - URI:rsync://rpki.apnic.net/member_repository/A919B06C/E9D62E74FEAE11E8910D4D66C4F9AE02/7BD51C0818B511EDB560256FC4F9AE02.roa
                RPKI Notify - URI:https://rrdp.apnic.net/notification.xml

            sbgp-ipAddrBlock: critical
                IPv4:
                  59.152.0.0/20
                IPv6:
                  2404:1b40::/32

    Signature Algorithm: sha256WithRSAEncryption
         27:b4:40:7a:6f:b9:91:0b:d4:6d:fa:a4:12:e2:a7:0f:25:d4:
         51:3f:50:0c:57:cf:7a:9e:4d:e0:80:85:19:76:8a:c4:0e:f0:
         43:c5:9c:4a:6c:16:ad:f5:33:73:6b:16:41:c8:b3:21:cf:90:
         a4:6d:49:0c:d1:ad:7a:d7:6e:2a:d9:e3:a8:f6:04:39:53:c9:
         f8:75:8d:52:b8:2f:97:95:bf:77:98:dd:2c:cc:d7:a6:c2:a8:
         80:c1:01:7f:4f:b9:b2:19:93:35:75:54:53:2b:74:81:f0:e9:
         93:14:6e:a9:28:34:6a:2e:ed:1b:8d:cd:cd:18:d2:d3:b1:57:
         c1:53:b6:92:f4:d1:75:49:fd:f8:13:b4:21:86:18:16:f8:cf:
         42:d9:38:78:cd:8d:87:c1:23:40:98:fa:b5:b3:a2:c1:23:63:
         60:47:88:d1:f0:35:78:31:43:42:f2:e9:2f:c0:52:ee:9b:95:
         e4:ad:ff:71:5f:77:a3:a8:94:51:8f:f8:0b:3e:45:bf:65:41:
         59:5f:e9:3c:08:0b:6f:8b:43:a6:66:94:e1:ca:a9:4c:8e:a7:
         63:08:1c:10:9f:fb:49:b2:10:f0:a0:8a:5e:16:53:a4:33:64:
         e5:eb:91:88:46:3d:78:c0:54:a9:9a:4a:73:b8:8a:07:03:ad:
         36:a0:65:99
-----BEGIN CERTIFICATE-----
MIIFgDCCBGigAwIBAgICDIYwDQYJKoZIhvcNAQELBQAwRjERMA8GA1UEAxMIQTkx
OUIwNkMxMTAvBgNVBAUTKEM4MzQ5M0MwMjk3Q0NCNThEMjgzNzk0NkQ2MDYzRjE0
QTdERUU5ODYwHhcNMjMwNTEwMTg1NzU2WhcNMjQwNTI5MDAwMDAwWjAYMRYwFAYD
VQQDEw02NDViZTkzNC01NGNjMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEA/K4g88rl7menmEtNF/+2DLPVnySUhwq2Q/TKx0bxBtXfia9fbCRO8wnjk7CY
rOYiuYjyyuiStudHRPeVosCtGlzz5kqhxE4NU3K6qSw9CERhxeOph/vKrTHMbVT5
6spCeGB0iO7XpMu95Ew+n51H0iQHflsn7fE2FsMcCbxC8JyW+FyorCpERDJHHz1v
oxMQT+M4UsFVP3iKRy1n8CotzKRWGWBnlSDf2Y13sBjeRLuGIqAXs5PGkOLTvzNL
PVI11wbp9S5vPDQtobaM9ou7cae2I1U06phoYxlo4XijcKCxCNQw58/gqWEIssc1
xntTMHHk11ZxuHmp6RleBzG9DwIDAQABo4ICpDCCAqAwHQYDVR0OBBYEFOKxmanJ
XBmU5asm3q2WEly/gKVXMB8GA1UdIwQYMBaAFMg0k8ApfMtY0oN5RtYGPxSn3umG
MA4GA1UdDwEB/wQEAwIHgDCBgwYDVR0fBHwwejB4oHagdIZycnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9tZW1iZXJfcmVwb3NpdG9yeS9BOTE5QjA2Qy9FOUQ2MkU3NEZF
QUUxMUU4OTEwRDRENjZDNEY5QUUwMi95RFNUd0NsOHkxalNnM2xHMWdZX0ZLZmU2
WVkuY3JsMH4GCCsGAQUFBwEBBHIwcDBuBggrBgEFBQcwAoZicnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9yZXBvc2l0b3J5L0I1MjdFRjU4MUQ2NjExRTJCQjQ2OEY3Qzcy
RkQxRkYyL3lEU1R3Q2w4eTFqU2czbEcxZ1lfRktmZTZZWS5jZXIwSgYDVR0gAQH/
BEAwPjA8BggrBgEFBQcOAjAwMC4GCCsGAQUFBwIBFiJodHRwczovL3d3dy5hcG5p
Yy5uZXQvUlBLSS9DUFMucGRmMIHLBggrBgEFBQcBCwSBvjCBuzCBgwYIKwYBBQUH
MAuGd3JzeW5jOi8vcnBraS5hcG5pYy5uZXQvbWVtYmVyX3JlcG9zaXRvcnkvQTkx
OUIwNkMvRTlENjJFNzRGRUFFMTFFODkxMEQ0RDY2QzRGOUFFMDIvN0JENTFDMDgx
OEI1MTFFREI1NjAyNTZGQzRGOUFFMDIucm9hMDMGCCsGAQUFBzANhidodHRwczov
L3JyZHAuYXBuaWMubmV0L25vdGlmaWNhdGlvbi54bWwwLgYIKwYBBQUHAQcBAf8E
HzAdMAwEAgABMAYDBAQ7mAAwDQQCAAIwBwMFACQEG0AwDQYJKoZIhvcNAQELBQAD
ggEBACe0QHpvuZEL1G36pBLipw8l1FE/UAxXz3qeTeCAhRl2isQO8EPFnEpsFq31
M3NrFkHIsyHPkKRtSQzRrXrXbirZ46j2BDlTyfh1jVK4L5eVv3eY3SzM16bCqIDB
AX9PubIZkzV1VFMrdIHw6ZMUbqkoNGou7RuNzc0Y0tOxV8FTtpL00XVJ/fgTtCGG
GBb4z0LZOHjNjYfBI0CY+rWzosEjY2BHiNHwNXgxQ0Ly6S/AUu6bleSt/3Ffd6Oo
lFGP+As+Rb9lQVlf6TwIC2+LQ6ZmlOHKqUyOp2MIHBCf+0myEPCgil4WU6QzZOXr
kYhGPXjAVKmaSnO4igcDrTagZZk=
-----END CERTIFICATE-----