Internet X.509 Public Key Infrastructure Operational Protocols: FTP and HTTP
Extracted elements (11)
FTP and HTTP are offered as alternatives to Directory access protocols for certificate and CRL distribution because Directory Services are not universally available on the Internet and both FTP (anonymous) and HTTP are widely deployed and accommodated by many firewalls.
These FTP/HTTP retrieval mechanisms satisfy only the requirement to retrieve information for a certificate already identified by a URI; they are not intended to solve the more general problem of finding certificates for users identified by email address or corporate affiliation.
The encoding for application/pkix-cert and application/pkix-crl MIME types will be none for 8-bit transports and most likely Base64 for SMTP or other 7-bit transports.
Files containing certificates should have a suffix of '.cer', and each '.cer' file must contain exactly one certificate encoded in DER format.
Files containing CRLs should have a suffix of '.crl', and each '.crl' file must contain exactly one CRL encoded in DER format.
The URI form of GeneralName within certificate and CRL extensions is used to specify the HTTP location where issuer certificates and CRLs may be obtained, expressed as an IA5String (e.g., http://www.your.org/pki/id48.cer).
MIME type 'application/pkix-cert' is registered for transferring DER-encoded X.509 certificates, with file extension .CER and optional 'version' parameter (default '1').
MIME type 'application/pkix-crl' is registered for transferring DER-encoded certificate revocation lists, with file extension .CRL and optional 'version' parameter (default '1').
Misconfigured or broken HTTP caching proxies may return out-of-date certificates or CRLs; clients should be aware that cached responses may not reflect the latest revocation state.
Operators of FTP sites and web servers should authenticate end entities who publish certificates, as well as CAs and RAs who publish certificates and CRLs, though authentication is not required for retrieval.
Since certificates and CRLs are digitally signed, no additional integrity service is necessary, and no privacy service is required because neither certificates nor CRLs need be kept secret; anonymous access is generally acceptable.