Route Origin Authorization

$ rpki-client -vvvf rpki-rsync.us-east-2.amazonaws.com/volume/fe3737fb-095d-444c-92f4-3f7221fb544c/a936f77c-971c-455b-97d6-b0b05543c41e.roa
File:                     a936f77c-971c-455b-97d6-b0b05543c41e.roa (raw, json)
Hash identifier:          sZB0irTWWxm/B/AFTe715husgzNupVCvVRurylELwzA=
Subject key identifier:   A7:36:7E:19:B1:22:70:ED:0B:7A:CC:0E:7E:CF:EF:B2:A9:14:81:08
Certificate issuer:       /CN=df759b5af3da6c9df033b0de998970a4e79655d0
Certificate serial:       0B7217C296A2BBB84AF205D5944E99F2EE9C92FA
Authority key identifier: DF:75:9B:5A:F3:DA:6C:9D:F0:33:B0:DE:99:89:70:A4:E7:96:55:D0
Authority info access:    rsync://rpki.ripe.net/repository/DEFAULT/33WbWvPabJ3wM7DemYlwpOeWVdA.cer
Subject info access:      rsync://rpki-rsync.us-east-2.amazonaws.com/volume/fe3737fb-095d-444c-92f4-3f7221fb544c/a936f77c-971c-455b-97d6-b0b05543c41e.roa
Signing time:             Fri 11 Sep 2026 00:00:08 +0000
ROA not before:           Fri 11 Sep 2026 00:00:08 +0000
ROA not after:            Thu 10 Dec 2026 23:59:59 +0000
asID:                     214101
IP address blocks:        2001:3fc7:3000::/40 maxlen: 40
Validation:               OK
Signature path:           rsync://rpki-rsync.us-east-2.amazonaws.com/volume/fe3737fb-095d-444c-92f4-3f7221fb544c/0XE5tZVyuGeaA_h7-1qBp7aY4So.crl
                          rsync://rpki-rsync.us-east-2.amazonaws.com/volume/fe3737fb-095d-444c-92f4-3f7221fb544c/0XE5tZVyuGeaA_h7-1qBp7aY4So.mft
                          rsync://rpki.ripe.net/repository/DEFAULT/33WbWvPabJ3wM7DemYlwpOeWVdA.cer
                          rsync://rpki.ripe.net/repository/DEFAULT/KpSo3VVK5wEHIJnHC2QHVV3d5mk.crl
                          rsync://rpki.ripe.net/repository/DEFAULT/KpSo3VVK5wEHIJnHC2QHVV3d5mk.mft
                          rsync://rpki.ripe.net/repository/aca/KpSo3VVK5wEHIJnHC2QHVV3d5mk.cer
                          rsync://rpki.ripe.net/repository/aca/7DNNDzoYvgAht7joQih2Qayxcxo.crl
                          rsync://rpki.ripe.net/repository/aca/7DNNDzoYvgAht7joQih2Qayxcxo.mft
                          rsync://rpki.ripe.net/repository/ec334d0f3a18be0021b7b8e842287641acb1731a.cer
                          rsync://rpki.ripe.net/repository/ripe-ncc-ta.crl
                          rsync://rpki.ripe.net/repository/ripe-ncc-ta.mft
                          rsync://rpki.ripe.net/ta/ripe-ncc-ta.cer
Signature path expires:   Mon 21 Sep 2026 23:00:07 +0000

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0b:72:17:c2:96:a2:bb:b8:4a:f2:05:d5:94:4e:99:f2:ee:9c:92:fa
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=df759b5af3da6c9df033b0de998970a4e79655d0
        Validity
            Not Before: Sep 11 00:00:08 2026 GMT
            Not After : Dec 10 23:59:59 2026 GMT
        Subject: serialNumber=208ff761c0a1ce518f5c94f565be9495677f1aea8313906fd6ba0575d643d204, CN=98d67deb-bb75-4e77-b1a0-36016b2d6350
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:ef:79:4c:2a:1b:5a:ac:c0:c5:73:ac:0c:bb:84:
                    de:bf:f1:5e:3c:d7:88:7e:5e:f6:31:97:1f:79:30:
                    2d:de:a1:d1:ee:ae:60:a7:6a:0d:d9:75:2e:5e:b7:
                    30:e4:37:e9:41:88:26:27:c6:7b:22:7f:43:24:bd:
                    63:11:3d:ae:b4:48:c5:5f:17:6b:1f:0c:5a:0e:b8:
                    f5:6e:02:c4:3e:f7:0e:5e:ad:89:d9:e1:00:f5:e0:
                    09:ca:5e:91:60:01:59:3a:f5:49:c1:74:b6:82:83:
                    a4:f9:c3:c3:db:18:ab:1a:fd:85:fa:49:83:88:4f:
                    b9:78:73:4a:f9:f4:b0:bd:10:d2:ba:80:65:01:af:
                    6f:0d:4c:77:44:46:4d:4f:f6:4e:a2:58:c3:72:6b:
                    8f:68:8b:7e:95:bd:8f:82:0e:c4:68:d4:09:c5:08:
                    be:13:8d:d1:da:09:bf:aa:1a:2b:c2:f3:6a:df:07:
                    e1:78:72:41:4a:19:49:d2:eb:ec:f6:93:d0:ee:50:
                    16:2a:79:be:30:48:72:f7:a1:a3:52:fb:b9:dc:c9:
                    c5:c0:a1:c1:3b:32:18:21:af:92:fd:91:e4:65:d7:
                    2c:79:51:ea:ae:82:08:b2:db:fb:61:92:8b:49:a3:
                    24:42:3e:b6:a2:3a:56:54:ce:cf:a5:3e:bd:46:55:
                    51:a5
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                A7:36:7E:19:B1:22:70:ED:0B:7A:CC:0E:7E:CF:EF:B2:A9:14:81:08
            X509v3 Authority Key Identifier:
                keyid:DF:75:9B:5A:F3:DA:6C:9D:F0:33:B0:DE:99:89:70:A4:E7:96:55:D0

            X509v3 Key Usage: critical
                Digital Signature
            Authority Information Access:
                CA Issuers - URI:rsync://rpki.ripe.net/repository/DEFAULT/33WbWvPabJ3wM7DemYlwpOeWVdA.cer

            Subject Information Access:
                Signed Object - URI:rsync://rpki-rsync.us-east-2.amazonaws.com/volume/fe3737fb-095d-444c-92f4-3f7221fb544c/a936f77c-971c-455b-97d6-b0b05543c41e.roa

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki-rsync.us-east-2.amazonaws.com/volume/fe3737fb-095d-444c-92f4-3f7221fb544c/0XE5tZVyuGeaA_h7-1qBp7aY4So.crl

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber

            sbgp-ipAddrBlock: critical
                IPv6:
                  2001:3fc7:3000::/40

    Signature Algorithm: sha256WithRSAEncryption
         54:24:88:34:84:b5:da:8e:92:79:7a:24:9b:39:f0:80:5a:d9:
         fa:ba:7e:33:ea:a8:be:51:3c:1b:b2:2a:cf:72:1f:a7:c4:bb:
         4c:53:88:37:36:e8:ac:35:43:e5:63:3c:ad:ad:f8:15:80:8b:
         9b:ac:b3:11:0c:ef:0b:ee:50:9c:96:48:52:38:d2:d9:e6:78:
         c4:37:20:88:13:a4:12:78:84:fb:cc:d7:3c:51:65:ab:6e:dc:
         3f:85:97:13:46:b4:cb:94:42:68:7e:ce:4e:85:d7:ac:15:a3:
         ee:9b:ea:4b:f5:e0:88:b8:02:69:81:06:c6:a8:f2:52:5d:be:
         b8:09:57:e9:08:42:8e:a8:1a:36:c6:a8:46:83:32:d3:bf:a2:
         ba:64:ea:63:b6:c5:c9:89:e2:91:c0:e8:c0:63:8f:16:06:12:
         eb:46:7f:77:4d:2e:b5:fa:ac:e4:6b:7d:9a:3e:e8:a5:b3:18:
         62:12:70:68:b8:28:75:8e:08:c2:b0:8b:58:ec:f2:86:ce:ca:
         c6:b5:1e:3f:d3:7a:12:3d:11:52:61:9b:b8:b2:b0:ba:17:8c:
         ef:2c:22:89:7b:e2:30:b1:de:4e:80:fc:de:53:f5:94:d6:3b:
         94:80:10:c8:12:fc:1a:95:68:54:c2:72:f6:86:de:69:63:5e:
         b9:93:f2:50
-----BEGIN CERTIFICATE-----
MIIFYDCCBEigAwIBAgIUC3IXwpaiu7hK8gXVlE6Z8u6ckvowDQYJKoZIhvcNAQEL
BQAwMzExMC8GA1UEAxMoZGY3NTliNWFmM2RhNmM5ZGYwMzNiMGRlOTk4OTcwYTRl
Nzk2NTVkMDAeFw0yNjA5MTEwMDAwMDhaFw0yNjEyMTAyMzU5NTlaMHoxSTBHBgNV
BAUTQDIwOGZmNzYxYzBhMWNlNTE4ZjVjOTRmNTY1YmU5NDk1Njc3ZjFhZWE4MzEz
OTA2ZmQ2YmEwNTc1ZDY0M2QyMDQxLTArBgNVBAMTJDk4ZDY3ZGViLWJiNzUtNGU3
Ny1iMWEwLTM2MDE2YjJkNjM1MDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBAO95TCobWqzAxXOsDLuE3r/xXjzXiH5e9jGXH3kwLd6h0e6uYKdqDdl1Ll63
MOQ36UGIJifGeyJ/QyS9YxE9rrRIxV8Xax8MWg649W4CxD73Dl6tidnhAPXgCcpe
kWABWTr1ScF0toKDpPnDw9sYqxr9hfpJg4hPuXhzSvn0sL0Q0rqAZQGvbw1Md0RG
TU/2TqJYw3Jrj2iLfpW9j4IOxGjUCcUIvhON0doJv6oaK8Lzat8H4XhyQUoZSdLr
7PaT0O5QFip5vjBIcveho1L7udzJxcChwTsyGCGvkv2R5GXXLHlR6q6CCLLb+2GS
i0mjJEI+tqI6VlTOz6U+vUZVUaUCAwEAAaOCAiMwggIfMB0GA1UdDgQWBBSnNn4Z
sSJw7Qt6zA5+z++yqRSBCDAfBgNVHSMEGDAWgBTfdZta89psnfAzsN6ZiXCk55ZV
0DAOBgNVHQ8BAf8EBAMCB4AwZAYIKwYBBQUHAQEEWDBWMFQGCCsGAQUFBzAChkhy
c3luYzovL3Jwa2kucmlwZS5uZXQvcmVwb3NpdG9yeS9ERUZBVUxULzMzV2JXdlBh
Ykozd003RGVtWWx3cE9lV1ZkQS5jZXIwgZ4GCCsGAQUFBwELBIGRMIGOMIGLBggr
BgEFBQcwC4Z/cnN5bmM6Ly9ycGtpLXJzeW5jLnVzLWVhc3QtMi5hbWF6b25hd3Mu
Y29tL3ZvbHVtZS9mZTM3MzdmYi0wOTVkLTQ0NGMtOTJmNC0zZjcyMjFmYjU0NGMv
YTkzNmY3N2MtOTcxYy00NTViLTk3ZDYtYjBiMDU1NDNjNDFlLnJvYTCBiAYDVR0f
BIGAMH4wfKB6oHiGdnJzeW5jOi8vcnBraS1yc3luYy51cy1lYXN0LTIuYW1hem9u
YXdzLmNvbS92b2x1bWUvZmUzNzM3ZmItMDk1ZC00NDRjLTkyZjQtM2Y3MjIxZmI1
NDRjLzBYRTV0WlZ5dUdlYUFfaDctMXFCcDdhWTRTby5jcmwwGAYDVR0gAQH/BA4w
DDAKBggrBgEFBQcOAjAhBggrBgEFBQcBBwEB/wQSMBAwDgQCAAIwCAMGACABP8cw
MA0GCSqGSIb3DQEBCwUAA4IBAQBUJIg0hLXajpJ5eiSbOfCAWtn6un4z6qi+UTwb
sirPch+nxLtMU4g3NuisNUPlYzytrfgVgIubrLMRDO8L7lCclkhSONLZ5njENyCI
E6QSeIT7zNc8UWWrbtw/hZcTRrTLlEJofs5OhdesFaPum+pL9eCIuAJpgQbGqPJS
Xb64CVfpCEKOqBo2xqhGgzLTv6K6ZOpjtsXJieKRwOjAY48WBhLrRn93TS61+qzk
a32aPuilsxhiEnBouCh1jgjCsItY7PKGzsrGtR4/03oSPRFSYZu4srC6F4zvLCKJ
e+Iwsd5OgPzeU/WU1juUgBDIEvwalWhUwnL2ht5pY165k/JQ
-----END CERTIFICATE-----