Internet X.509 Public Key Infrastructure Authority Information Access Certificate Revocation List (CRL) Extension
obsoleted by
- rfc-5280 — Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
updates
- rfc-3280 — Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
Extracted elements (16)
Existing methods such as directory lookup and the Subject Information Access extension in intermediary CA certificates require either a populated directory or top-down path construction; the AIA CRL extension enables bottom-up discovery directly from the CRL, complementing these approaches.
The AIA CRL extension was introduced because in several legitimate scenarios (indirect CRLs, CA key changes, separate certificate/CRL signing keys) the CRL issuer certificate is not present or easily discoverable from the target certification path, making bottom-up path construction difficult.
Consuming clients may use the MIME type and file extension as a hint to the file content, but should not depend solely on the presence of the correct MIME type or file extension in the server response.
At least one instance of AccessDescription SHOULD specify an accessLocation that is an HTTP or LDAP URI.
Conforming applications that support HTTP or FTP for accessing certificates MUST be able to accept .cer files and SHOULD be able to accept .p7c files.
HTTP servers accessed via the URI SHOULD use the appropriate MIME content-type: application/pkix-cert for a single DER encoded certificate and application/pkcs7-mime for CMS certs-only (PKCS#7).
Implementations that support the directoryName form of accessLocation MUST be prepared to find the needed certificate in any of the crossCertificatePair, cACertificate, or userCertificate attributes.
The AIA CRL extension MUST be identified by the OID 1.3.6.1.5.5.7.1.1, and the AuthorityInfoAccessSyntax MUST be used to form the extension value.
The Authority Information Access CRL extension MUST NOT be marked critical.
When present in a CRL, the AIA extension MUST include at least one AccessDescription specifying id-ad-caIssuers as the accessMethod. Access method types other than id-ad-caIssuers MUST NOT be included.
Where information is available via HTTP or FTP, accessLocation MUST be a uniformResourceIdentifier and the URI MUST point to a certificate-containing file with either a .cer (single DER-encoded certificate) or .p7c (certs-only CMS message) extension.
Where information is available via LDAP, the accessLocation SHOULD be a uniformResourceIdentifier, and the URI MUST specify a distinguishedName and attribute(s) and list appropriate attribute descriptions for one or more attributes holding certificates or cross-certificate pairs.
A .cer file contains a single DER encoded certificate as specified in RFC 2585; a .p7c file contains a certs-only CMS message as specified in RFC 2797.
The id-ad-caIssuers access method (OID 1.3.6.1.5.5.7.48.2) is the only permitted accessMethod in the AIA CRL extension, used to locate CA certificates useful for constructing a valid CRL issuer certification path.
Implementers should be aware of risks if the AIA extensions of corrupted CRLs contain links to malicious code, and should always validate retrieved data to ensure it is properly formed. Additionally, the possible existence of multiple unrelated CAs and CRL issuers with the same name should be taken into account.
The AuthorityInfoAccessSyntax is a SEQUENCE SIZE (1..MAX) OF AccessDescription, where each AccessDescription contains an accessMethod OID and an accessLocation GeneralName. Identified by OID 1.3.6.1.5.5.7.1.1.