Skip to content

Instantly share code, notes, and snippets.

@tonusoo

tonusoo/ROA-ASPA-openssl.txt

Created March 30, 2026 14:21
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save tonusoo/b16f6109431099eed0ad0d14bbf8216f to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save tonusoo/b16f6109431099eed0ad0d14bbf8216f to your computer and use it in GitHub Desktop.
Download ZIP
Extracting and decoding the ASN.1 DER payloads of RPKI CMS signed objects using OpenSSL
Raw
ROA-ASPA-openssl.txt
martin@validator-2:~$ # routinator dump --output /tmp/routinator-dump/
martin@validator-2:~$ # "<- ..." comments below are manually added
martin@validator-2:~$ openssl cms -verify -noverify -inform DER -in /tmp/routinator-dump/store/rrdp.arin.net/rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/69fd0156-bb1f-48b6-bf32-c9492286f195/de4a1dfa-8867-4aef-a2e6-131e93add9f9/5486ade0-fc94-3e8d-89dc-e03fab376ea9.roa -outform DER | openssl asn1parse -inform DER -i -dump
CMS Verification successful
0:d=0 hl=2 l= 28 cons: SEQUENCE
2:d=1 hl=2 l= 3 prim: INTEGER :02571B <- ASN 153371 (RFC 6482 ASID)
7:d=1 hl=2 l= 21 cons: SEQUENCE
9:d=2 hl=2 l= 19 cons: SEQUENCE
11:d=3 hl=2 l= 2 prim: OCTET STRING
0000 - 00 02 .. <- v6 addr family (RFC 6482 addressFamily)
15:d=3 hl=2 l= 13 cons: SEQUENCE
17:d=4 hl=2 l= 11 cons: SEQUENCE
19:d=5 hl=2 l= 6 prim: BIT STRING
0000 - 04 26 02 f7 b1 00 .&.... <- 2602:f7b1::/36 ("26 02 f7 b1 00" is 40 bits and the prefix len is found by subtracting the 04; RFC 6482 IPAddress)
27:d=5 hl=2 l= 1 prim: INTEGER :30 <- maxlen 48 (RFC 6482 maxLength)
martin@validator-2:~$
martin@validator-2:~$ openssl cms -verify -noverify -inform DER -in /tmp/routinator-dump/store/rrdp.arin.net/rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/69fd0156-bb1f-48b6-bf32-c9492286f195/f9afd038-6c26-42a9-a216-ccb00c16c4d2/41d9d6c7-d382-3809-be0c-b78dfba0d9f0.roa -outform DER | openssl asn1parse -inform DER -i -dump
CMS Verification successful
0:d=0 hl=2 l= 57 cons: SEQUENCE
2:d=1 hl=2 l= 3 prim: INTEGER :061537 <- ASN 398647
7:d=1 hl=2 l= 50 cons: SEQUENCE
9:d=2 hl=2 l= 30 cons: SEQUENCE
11:d=3 hl=2 l= 2 prim: OCTET STRING
0000 - 00 01 .. <- v4 addr family
15:d=3 hl=2 l= 24 cons: SEQUENCE
17:d=4 hl=2 l= 6 cons: SEQUENCE
19:d=5 hl=2 l= 4 prim: BIT STRING
0000 - 00 c7 49 5d ..I] <- 199.73.93/24 (24 bits - 00)
25:d=4 hl=2 l= 6 cons: SEQUENCE
27:d=5 hl=2 l= 4 prim: BIT STRING
0000 - 00 c7 49 5e ..I^ <- 199.73.94/24 (24 bits - 00)
33:d=4 hl=2 l= 6 cons: SEQUENCE
35:d=5 hl=2 l= 4 prim: BIT STRING
0000 - 00 c7 49 5f ..I_ <- 199.73.95/24 (24 bits - 00)
41:d=2 hl=2 l= 16 cons: SEQUENCE
43:d=3 hl=2 l= 2 prim: OCTET STRING
0000 - 00 02 .. <- v6 addr family
47:d=3 hl=2 l= 10 cons: SEQUENCE
49:d=4 hl=2 l= 8 cons: SEQUENCE
51:d=5 hl=2 l= 6 prim: BIT STRING
0000 - 04 26 02 fb e0 00 .&.... <- 2602:fbe0::/36 (40 bits - 04)
martin@validator-2:~$
martin@validator-2:~$ openssl cms -verify -noverify -inform DER -in /tmp/routinator-dump/store/rrdp.arin.net/rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/f60c9f32-a87c-4339-a2f3-6299a3b02e29/6bf0b484-94d2-490f-8a68-d7588d1f3683/b1cfaa2d-9297-3b45-aae8-b56d88f98e2f.asa -outform DER | openssl asn1parse -inform DER -i -dump
CMS Verification successful
0:d=0 hl=2 l= 40 cons: SEQUENCE
2:d=1 hl=2 l= 3 cons: cont [ 0 ]
4:d=2 hl=2 l= 1 prim: INTEGER :01 <- version number; https://datatracker.ietf.org/doc/html/draft-ietf-sidrops-aspa-profile#section-3.1
7:d=1 hl=2 l= 3 prim: INTEGER :061084 <- ASN 397444
12:d=1 hl=2 l= 28 cons: SEQUENCE
14:d=2 hl=2 l= 2 prim: INTEGER :1B1B <- ASN 6939
18:d=2 hl=2 l= 2 prim: INTEGER :4FF9 <- ASN 20473
22:d=2 hl=2 l= 3 prim: INTEGER :D1A3 <- ASN 53667
27:d=2 hl=2 l= 3 prim: INTEGER :D48F <- ASN 54415
32:d=2 hl=2 l= 3 prim: INTEGER :DD36 <- ASN 56630
37:d=2 hl=2 l= 3 prim: INTEGER :0622BA <- ASN 402106
martin@validator-2:~$
martin@validator-2:~$
martin@validator-2:~$ # rpki-client output for comparison
martin@validator-2:~$ rpki-client -vv -f /tmp/routinator-dump/store/rrdp.arin.net/rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/f60c9f32-a87c-4339-a2f3-6299a3b02e29/6bf0b484-94d2-490f-8a68-d7588d1f3683/b1cfaa2d-9297-3b45-aae8-b56d88f98e2f.asa
File: /tmp/routinator-dump/store/rrdp.arin.net/rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/f60c9f32-a87c-4339-a2f3-6299a3b02e29/6bf0b484-94d2-490f-8a68-d7588d1f3683/b1cfaa2d-9297-3b45-aae8-b56d88f98e2f.asa
Hash identifier: H8fgNEwK/XlTAWkK+goO7TyLs1+oDMd1ond7dMVOG/0=
Subject key identifier: D6:4D:B4:AA:40:22:F6:58:23:EF:F2:83:E7:D1:0C:6E:65:8D:9B:92
Certificate issuer: /CN=6bf0b484-94d2-490f-8a68-d7588d1f3683
Certificate serial: 010D0C9F4328584CEE20E513D267D0EEDA760F80
Authority key identifier: 2C:7F:1E:92:2A:96:B9:4C:13:5E:EB:5C:38:45:77:97:4A:C6:5E:5C
Authority info access: rsync://rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/f60c9f32-a87c-4339-a2f3-6299a3b02e29/6bf0b484-94d2-490f-8a68-d7588d1f3683.cer
Subject info access: rsync://rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/f60c9f32-a87c-4339-a2f3-6299a3b02e29/6bf0b484-94d2-490f-8a68-d7588d1f3683/b1cfaa2d-9297-3b45-aae8-b56d88f98e2f.asa
Signing time: Fri 20 Feb 2026 22:23:18 +0000
ASPA not before: Fri 20 Feb 2026 22:23:18 +0000
ASPA not after: Thu 21 May 2026 21:23:18 +0000
Customer ASID: 397444
Providers: AS: 6939
AS: 20473
AS: 53667
AS: 54415
AS: 56630
AS: 402106
Validation: OK
Signature path: rsync://rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/f60c9f32-a87c-4339-a2f3-6299a3b02e29/6bf0b484-94d2-490f-8a68-d7588d1f3683/6bf0b484-94d2-490f-8a68-d7588d1f3683.crl
rsync://rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/f60c9f32-a87c-4339-a2f3-6299a3b02e29/6bf0b484-94d2-490f-8a68-d7588d1f3683/6bf0b484-94d2-490f-8a68-d7588d1f3683.mft
rsync://rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/f60c9f32-a87c-4339-a2f3-6299a3b02e29/6bf0b484-94d2-490f-8a68-d7588d1f3683.cer
rsync://rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/f60c9f32-a87c-4339-a2f3-6299a3b02e29/f60c9f32-a87c-4339-a2f3-6299a3b02e29.crl
rsync://rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/f60c9f32-a87c-4339-a2f3-6299a3b02e29/f60c9f32-a87c-4339-a2f3-6299a3b02e29.mft
rsync://rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/f60c9f32-a87c-4339-a2f3-6299a3b02e29.cer
rsync://rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/5e4a23ea-e80a-403e-b08c-2171da2157d3.crl
rsync://rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/5e4a23ea-e80a-403e-b08c-2171da2157d3.mft
rsync://rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3.cer
rsync://rpki.arin.net/repository/arin-rpki-ta/arin-rpki-ta.crl
rsync://rpki.arin.net/repository/arin-rpki-ta/arin-rpki-ta.mft
rsync://rpki.arin.net/repository/arin-rpki-ta.cer
Signature path expires: Tue 31 Mar 2026 21:00:00 +0000
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
01:0d:0c:9f:43:28:58:4c:ee:20:e5:13:d2:67:d0:ee:da:76:0f:80
Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=6bf0b484-94d2-490f-8a68-d7588d1f3683
Validity
Not Before: Feb 20 22:23:18 2026 GMT
Not After : May 21 21:23:18 2026 GMT
Subject: CN=8271c7ab-9572-4a51-9a07-79b4cfda4d0e
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:a7:f0:2e:06:38:1a:b0:3b:18:b1:1a:33:be:44:
f0:a9:27:bb:89:d9:cd:62:b7:47:50:ca:6e:7b:35:
84:c1:e3:1b:7b:1d:64:fe:a8:35:f1:01:e1:3b:21:
ae:86:f7:0a:8f:d1:54:b3:b1:5c:e8:ad:9d:64:d4:
64:0a:55:e6:2e:7c:0b:fc:7f:83:d0:87:3b:67:2c:
64:6d:8c:21:d8:59:3f:94:81:71:9e:92:40:49:56:
14:a2:27:84:a2:9b:65:0a:1f:de:22:4a:0e:fc:92:
d8:73:77:80:33:ea:3e:7a:43:e8:2f:aa:fc:8b:8e:
4d:4e:14:9d:3b:24:bc:ba:26:f7:f1:ad:9b:e2:3a:
0e:24:ed:cd:ab:25:2e:1e:27:7d:12:37:f0:a7:fb:
34:e8:4e:0a:76:ca:d5:77:69:d8:f9:03:47:46:e4:
81:de:3c:7d:74:fc:6c:11:fb:42:99:2c:91:92:2d:
26:66:6d:c4:3d:c9:01:f5:c7:30:5a:57:9d:89:02:
0b:6c:93:98:9b:5a:d1:a9:79:e7:7d:42:56:04:ec:
15:d7:ab:58:ab:78:2b:61:ce:be:3a:b7:8d:8e:92:
95:2d:ac:cc:e4:12:49:88:e4:e2:12:d6:79:a8:eb:
86:cd:28:2a:35:d8:0e:c7:1f:41:fe:fe:30:e2:4a:
75:47
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Subject Key Identifier:
D6:4D:B4:AA:40:22:F6:58:23:EF:F2:83:E7:D1:0C:6E:65:8D:9B:92
Subject Information Access:
Signed Object - URI:rsync://rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/f60c9f32-a87c-4339-a2f3-6299a3b02e29/6bf0b484-94d2-490f-8a68-d7588d1f3683/b1cfaa2d-9297-3b45-aae8-b56d88f98e2f.asa
X509v3 CRL Distribution Points:
Full Name:
URI:rsync://rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/f60c9f32-a87c-4339-a2f3-6299a3b02e29/6bf0b484-94d2-490f-8a68-d7588d1f3683/6bf0b484-94d2-490f-8a68-d7588d1f3683.crl
X509v3 Authority Key Identifier:
2C:7F:1E:92:2A:96:B9:4C:13:5E:EB:5C:38:45:77:97:4A:C6:5E:5C
X509v3 Key Usage: critical
Digital Signature
Authority Information Access:
CA Issuers - URI:rsync://rpki.arin.net/repository/arin-rpki-ta/5e4a23ea-e80a-403e-b08c-2171da2157d3/f60c9f32-a87c-4339-a2f3-6299a3b02e29/6bf0b484-94d2-490f-8a68-d7588d1f3683.cer
sbgp-autonomousSysNum: critical
Autonomous System Numbers:
397444
X509v3 Certificate Policies: critical
Policy: ipAddr-asNumber
CPS: https://www.arin.net/resources/rpki/cps.html
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
22:fd:cb:fc:44:42:80:29:96:a5:2d:74:b4:13:9e:45:d8:67:
45:0c:96:3c:0f:dd:2f:e1:74:d5:2f:50:d6:57:25:96:ef:64:
73:83:9c:44:2d:e1:b0:78:2a:33:80:bc:7e:6a:9c:8a:cd:4e:
25:12:0c:a7:4a:ea:8a:0f:fd:ba:4c:a7:90:46:2b:ff:55:c2:
ac:81:e1:51:74:45:4d:d3:83:4e:20:ca:39:e5:91:56:0a:5a:
b9:c6:64:1e:e6:16:cc:b1:92:f7:14:59:5e:29:e0:04:af:16:
4b:8d:69:f3:75:c5:5f:2e:13:10:87:f1:96:0e:fa:a5:b6:fd:
1a:9c:49:aa:7a:72:b6:0d:6d:21:41:b2:3d:e3:a0:74:be:48:
ac:86:61:15:64:e1:e3:2b:5b:86:30:22:41:e3:fd:fc:34:7e:
8f:72:3f:40:69:0b:3a:40:6d:87:9f:97:34:ae:4d:c1:08:3a:
a8:8c:8c:b5:0c:ec:e3:be:2d:35:e6:42:9b:b6:00:ee:68:72:
40:17:43:0c:05:6c:80:5c:95:a3:dc:23:95:70:30:1a:3f:6a:
9a:cc:c4:7a:92:3d:31:69:e6:a6:40:6a:17:a6:57:0c:81:d0:
1c:49:79:b2:a7:45:38:5f:2b:d4:ca:d2:29:6a:13:ec:58:6b:
f6:42:4c:e4
-----BEGIN CERTIFICATE-----
MIIGPjCCBSagAwIBAgIUAQ0Mn0MoWEzuIOUT0mfQ7tp2D4AwDQYJKoZIhvcNAQEL
BQAwLzEtMCsGA1UEAxMkNmJmMGI0ODQtOTRkMi00OTBmLThhNjgtZDc1ODhkMWYz
NjgzMB4XDTI2MDIyMDIyMjMxOFoXDTI2MDUyMTIxMjMxOFowLzEtMCsGA1UEAxMk
ODI3MWM3YWItOTU3Mi00YTUxLTlhMDctNzliNGNmZGE0ZDBlMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEAp/AuBjgasDsYsRozvkTwqSe7idnNYrdHUMpu
ezWEweMbex1k/qg18QHhOyGuhvcKj9FUs7Fc6K2dZNRkClXmLnwL/H+D0Ic7Zyxk
bYwh2Fk/lIFxnpJASVYUoieEoptlCh/eIkoO/JLYc3eAM+o+ekPoL6r8i45NThSd
OyS8uib38a2b4joOJO3NqyUuHid9Ejfwp/s06E4KdsrVd2nY+QNHRuSB3jx9dPxs
EftCmSyRki0mZm3EPckB9ccwWlediQILbJOYm1rRqXnnfUJWBOwV16tYq3grYc6+
OreNjpKVLazM5BJJiOTiEtZ5qOuGzSgqNdgOxx9B/v4w4kp1RwIDAQABo4IDUDCC
A0wwHQYDVR0OBBYEFNZNtKpAIvZYI+/yg+fRDG5ljZuSMIHlBggrBgEFBQcBCwSB
2DCB1TCB0gYIKwYBBQUHMAuGgcVyc3luYzovL3Jwa2kuYXJpbi5uZXQvcmVwb3Np
dG9yeS9hcmluLXJwa2ktdGEvNWU0YTIzZWEtZTgwYS00MDNlLWIwOGMtMjE3MWRh
MjE1N2QzL2Y2MGM5ZjMyLWE4N2MtNDMzOS1hMmYzLTYyOTlhM2IwMmUyOS82YmYw
YjQ4NC05NGQyLTQ5MGYtOGE2OC1kNzU4OGQxZjM2ODMvYjFjZmFhMmQtOTI5Ny0z
YjQ1LWFhZTgtYjU2ZDg4Zjk4ZTJmLmFzYTCB3AYDVR0fBIHUMIHRMIHOoIHLoIHI
hoHFcnN5bmM6Ly9ycGtpLmFyaW4ubmV0L3JlcG9zaXRvcnkvYXJpbi1ycGtpLXRh
LzVlNGEyM2VhLWU4MGEtNDAzZS1iMDhjLTIxNzFkYTIxNTdkMy9mNjBjOWYzMi1h
ODdjLTQzMzktYTJmMy02Mjk5YTNiMDJlMjkvNmJmMGI0ODQtOTRkMi00OTBmLThh
NjgtZDc1ODhkMWYzNjgzLzZiZjBiNDg0LTk0ZDItNDkwZi04YTY4LWQ3NTg4ZDFm
MzY4My5jcmwwHwYDVR0jBBgwFoAULH8ekiqWuUwTXutcOEV3l0rGXlwwDgYDVR0P
AQH/BAQDAgeAMIHABggrBgEFBQcBAQSBszCBsDCBrQYIKwYBBQUHMAKGgaByc3lu
YzovL3Jwa2kuYXJpbi5uZXQvcmVwb3NpdG9yeS9hcmluLXJwa2ktdGEvNWU0YTIz
ZWEtZTgwYS00MDNlLWIwOGMtMjE3MWRhMjE1N2QzL2Y2MGM5ZjMyLWE4N2MtNDMz
OS1hMmYzLTYyOTlhM2IwMmUyOS82YmYwYjQ4NC05NGQyLTQ5MGYtOGE2OC1kNzU4
OGQxZjM2ODMuY2VyMBoGCCsGAQUFBwEIAQH/BAswCaAHMAUCAwYQhDBUBgNVHSAB
Af8ESjBIMEYGCCsGAQUFBw4CMDowOAYIKwYBBQUHAgEWLGh0dHBzOi8vd3d3LmFy
aW4ubmV0L3Jlc291cmNlcy9ycGtpL2Nwcy5odG1sMA0GCSqGSIb3DQEBCwUAA4IB
AQAi/cv8REKAKZalLXS0E55F2GdFDJY8D90v4XTVL1DWVyWW72Rzg5xELeGweCoz
gLx+apyKzU4lEgynSuqKD/26TKeQRiv/VcKsgeFRdEVN04NOIMo55ZFWClq5xmQe
5hbMsZL3FFleKeAErxZLjWnzdcVfLhMQh/GWDvqltv0anEmqenK2DW0hQbI946B0
vkishmEVZOHjK1uGMCJB4/38NH6Pcj9AaQs6QG2Hn5c0rk3BCDqojIy1DOzjvi01
5kKbtgDuaHJAF0MMBWyAXJWj3COVcDAaP2qazMR6kj0xaeamQGoXplcMgdAcSXmy
p0U4XyvUytIpahPsWGv2Qkzk
-----END CERTIFICATE-----
martin@validator-2:~$
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment