Route Origin Authorization

$ rpki-client -vvf rpki.ripe.net/repository/DEFAULT/4d/deb648-f433-43f1-9c83-d0edec9728e5/1/hqd990q1gLSW7SBs-f4MtsS4OUs.roa
File:                     hqd990q1gLSW7SBs-f4MtsS4OUs.roa (raw, json)
Hash identifier:          Cj5NNPUEfRQP2HpFQ4Vq0r88rz0ljjQnf6HR7Q/0ozE=
Subject key identifier:   86:A7:7D:F7:4A:B5:80:B4:96:ED:20:6C:F9:FE:0C:B6:C4:B8:39:4B
Certificate issuer:       /CN=8fa2f88926e0bd8401c73cedb77e99c94dcc52d7
Certificate serial:       0194266AC08587E66177B6B4E5318B7901DF
Authority key identifier: 8F:A2:F8:89:26:E0:BD:84:01:C7:3C:ED:B7:7E:99:C9:4D:CC:52:D7
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/j6L4iSbgvYQBxzztt36ZyU3MUtc.cer
Subject info access:      rsync://rpki.ripe.net/repository/DEFAULT/4d/deb648-f433-43f1-9c83-d0edec9728e5/1/hqd990q1gLSW7SBs-f4MtsS4OUs.roa
Signing time:             Thu 02 Jan 2025 09:48:37 +0000
ROA not before:           Thu 02 Jan 2025 09:48:37 +0000
ROA not after:            Wed 01 Jul 2026 00:00:00 +0000
asID:                     212903
IP address blocks:        91.211.3.0/24 maxlen: 24
                          2a0c:8740::/29 maxlen: 29

Validation:               Failed, unable to get local issuer certificate

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:94:26:6a:c0:85:87:e6:61:77:b6:b4:e5:31:8b:79:01:df
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=8fa2f88926e0bd8401c73cedb77e99c94dcc52d7
        Validity
            Not Before: Jan  2 09:48:37 2025 GMT
            Not After : Jul  1 00:00:00 2026 GMT
        Subject: CN=86a77df74ab580b496ed206cf9fe0cb6c4b8394b
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:db:9c:b9:7e:6f:cf:ab:fc:d0:6b:1d:e0:89:e8:
                    8b:51:f4:cb:6e:5e:f6:f7:c4:d2:5d:9f:e3:2b:5f:
                    27:dd:df:b2:f0:ba:2e:54:45:0d:3f:ab:93:d2:95:
                    42:f9:c2:fa:23:97:bd:75:5f:32:c3:c9:12:b8:a8:
                    a3:47:39:09:a4:e5:12:26:27:5f:a5:bf:c2:b6:78:
                    92:6d:0d:11:74:33:c1:b9:0a:09:0d:0b:49:6c:2e:
                    bf:71:3f:24:e5:bc:b5:73:ef:cb:e2:2b:0b:b7:e5:
                    32:7b:75:9e:72:f6:49:37:c8:bc:43:c4:17:cf:0a:
                    e1:fc:42:58:d5:01:81:45:01:02:c5:dc:82:ca:cb:
                    3f:f1:a2:bf:0f:8b:f1:71:6b:c8:0b:ac:ed:45:9b:
                    27:d5:39:fd:ed:10:28:43:4b:a5:f1:8a:27:bc:10:
                    91:d9:51:9d:23:dd:6b:b3:ea:f3:3c:b7:d5:38:c5:
                    02:18:70:8d:5f:81:72:1c:21:90:42:bc:66:7b:a5:
                    b3:0b:dd:e4:7e:c3:57:34:e2:ea:bf:c4:b8:e3:5e:
                    5e:57:75:4c:8f:2b:94:e8:f6:a8:bd:87:3a:fe:83:
                    3e:99:16:8e:ae:60:92:6b:f4:a8:c7:f5:87:00:bb:
                    9e:5d:83:43:e1:c6:93:df:33:35:2b:36:3d:e3:63:
                    f9:b9
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                86:A7:7D:F7:4A:B5:80:B4:96:ED:20:6C:F9:FE:0C:B6:C4:B8:39:4B
            X509v3 Authority Key Identifier:
                keyid:8F:A2:F8:89:26:E0:BD:84:01:C7:3C:ED:B7:7E:99:C9:4D:CC:52:D7

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/j6L4iSbgvYQBxzztt36ZyU3MUtc.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki.ripe.net/repository/DEFAULT/4d/deb648-f433-43f1-9c83-d0edec9728e5/1/hqd990q1gLSW7SBs-f4MtsS4OUs.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.ripe.net/repository/DEFAULT/4d/deb648-f433-43f1-9c83-d0edec9728e5/1/j6L4iSbgvYQBxzztt36ZyU3MUtc.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv4:
                  91.211.3.0/24
                IPv6:
                  2a0c:8740::/29

    Signature Algorithm: sha256WithRSAEncryption
         6d:82:8d:a4:80:b8:19:70:2c:b6:82:92:11:04:4e:32:02:4b:
         32:02:4c:22:e1:c9:d6:c3:31:87:88:da:98:19:b8:1f:d8:87:
         1d:fe:65:f8:55:9e:b6:b2:80:12:bd:3c:98:57:66:61:a4:0f:
         13:2e:39:30:a9:9d:a7:cc:89:4d:2a:0e:e4:3c:86:8b:f6:43:
         b8:e3:a7:d0:98:67:18:59:18:5a:bf:71:42:de:10:9b:b4:ca:
         e8:ea:86:e1:34:fa:ed:da:ce:00:40:52:05:55:70:91:97:f0:
         65:b1:2a:18:3d:a2:a3:a3:66:79:a7:58:50:7d:6b:87:ad:36:
         1a:9a:19:fe:2a:72:f8:c8:d4:97:28:54:2c:26:5c:7f:6e:4a:
         c9:a2:6b:ba:fd:46:15:00:82:fb:1a:77:25:e0:3e:9e:2e:ec:
         d9:ca:04:c6:db:3c:54:a5:9d:79:b5:a5:a5:40:ce:ac:8a:ab:
         51:9e:96:c1:9b:93:51:75:88:32:cc:ef:78:4e:0a:0b:8a:a7:
         42:3a:e7:97:0e:ff:18:b3:db:9e:3c:d1:56:7d:91:ed:85:51:
         b2:f0:27:37:1c:0b:97:4b:6d:88:04:aa:e9:72:97:f9:01:52:
         a5:a5:b0:fe:fe:33:6e:91:f6:c4:b7:b9:62:26:54:86:52:70:
         5a:11:c5:66
-----BEGIN CERTIFICATE-----
MIIFDDCCA/SgAwIBAgISAZQmasCFh+Zhd7a05TGLeQHfMA0GCSqGSIb3DQEBCwUA
MDMxMTAvBgNVBAMTKDhmYTJmODg5MjZlMGJkODQwMWM3M2NlZGI3N2U5OWM5NGRj
YzUyZDcwHhcNMjUwMTAyMDk0ODM3WhcNMjYwNzAxMDAwMDAwWjAzMTEwLwYDVQQD
Eyg4NmE3N2RmNzRhYjU4MGI0OTZlZDIwNmNmOWZlMGNiNmM0YjgzOTRiMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA25y5fm/Pq/zQax3gieiLUfTLbl72
98TSXZ/jK18n3d+y8LouVEUNP6uT0pVC+cL6I5e9dV8yw8kSuKijRzkJpOUSJidf
pb/CtniSbQ0RdDPBuQoJDQtJbC6/cT8k5by1c+/L4isLt+Uye3WecvZJN8i8Q8QX
zwrh/EJY1QGBRQECxdyCyss/8aK/D4vxcWvIC6ztRZsn1Tn97RAoQ0ul8YonvBCR
2VGdI91rs+rzPLfVOMUCGHCNX4FyHCGQQrxme6WzC93kfsNXNOLqv8S4415eV3VM
jyuU6PaovYc6/oM+mRaOrmCSa/Sox/WHALueXYND4caT3zM1KzY942P5uQIDAQAB
o4ICGDCCAhQwHQYDVR0OBBYEFIanffdKtYC0lu0gbPn+DLbEuDlLMB8GA1UdIwQY
MBaAFI+i+Ikm4L2EAcc87bd+mclNzFLXMA4GA1UdDwEB/wQEAwIHgDBkBggrBgEF
BQcBAQRYMFYwVAYIKwYBBQUHMAKGSHJzeW5jOi8vcnBraS5yaXBlLm5ldC9yZXBv
c2l0b3J5L0RFRkFVTFQvajZMNGlTYmd2WVFCeHp6dHQzNlp5VTNNVXRjLmNlcjCB
jQYIKwYBBQUHAQsEgYAwfjB8BggrBgEFBQcwC4ZwcnN5bmM6Ly9ycGtpLnJpcGUu
bmV0L3JlcG9zaXRvcnkvREVGQVVMVC80ZC9kZWI2NDgtZjQzMy00M2YxLTljODMt
ZDBlZGVjOTcyOGU1LzEvaHFkOTkwcTFnTFNXN1NCcy1mNE10c1M0T1VzLnJvYTCB
gQYDVR0fBHoweDB2oHSgcoZwcnN5bmM6Ly9ycGtpLnJpcGUubmV0L3JlcG9zaXRv
cnkvREVGQVVMVC80ZC9kZWI2NDgtZjQzMy00M2YxLTljODMtZDBlZGVjOTcyOGU1
LzEvajZMNGlTYmd2WVFCeHp6dHQzNlp5VTNNVXRjLmNybDAYBgNVHSABAf8EDjAM
MAoGCCsGAQUFBw4CMC4GCCsGAQUFBwEHAQH/BB8wHTAMBAIAATAGAwQAW9MDMA0E
AgACMAcDBQMqDIdAMA0GCSqGSIb3DQEBCwUAA4IBAQBtgo2kgLgZcCy2gpIRBE4y
AksyAkwi4cnWwzGHiNqYGbgf2Icd/mX4VZ62soASvTyYV2ZhpA8TLjkwqZ2nzIlN
Kg7kPIaL9kO446fQmGcYWRhav3FC3hCbtMro6obhNPrt2s4AQFIFVXCRl/BlsSoY
PaKjo2Z5p1hQfWuHrTYamhn+KnL4yNSXKFQsJlx/bkrJomu6/UYVAIL7Gncl4D6e
LuzZygTG2zxUpZ15taWlQM6siqtRnpbBm5NRdYgyzO94TgoLiqdCOueXDv8Ys9ue
PNFWfZHthVGy8Cc3HAuXS22IBKrpcpf5AVKlpbD+/jNukfbEt7liJlSGUnBaEcVm
-----END CERTIFICATE-----