Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What file format is most appropriate or secure for the AIA record in a PKI certificate?

The options I'm aware of are:

  • DER encoded binary X.509 (.cer)
  • Base-64 encoded X.509 (.cer)

I also have the ability to save as .P7B but don't think that's a supported choice with AIA certs.

share|improve this question
This seems more appropriate for Server Fault. – Iszi Oct 12 '12 at 15:22
I posted here just because I thought the AIA record format is of significance to the IT Sec community. This isn't Windows-specific. Perhaps one format is more secure than the other? – LamonteCristo Oct 12 '12 at 15:24
@Iszi I disagree, he's not asking "how to create the .cer", he's asking which is a better choice, from a security PoV. On topic. – AviD Oct 14 '12 at 8:17
To @Iszi's credit, he is commenting on the first version of this post. I revised it to make it clearly on topic – LamonteCristo Oct 14 '12 at 14:22
up vote 2 down vote accepted

The Authority Information Access extension, which is added into certificates issued by a given CA, should contain a URL which points at a download location for the certificate of that said CA. This is described in section of RFC 5280, in particular with this paragraph:

Where the information is available via HTTP or FTP, accessLocation MUST be a uniformResourceIdentifier and the URI MUST point to either a single DER encoded certificate as specified in [RFC2585] or a collection of certificates in a BER or DER encoded "certs-only" CMS message as specified in [RFC2797].

So that's either binary DER (not Base64), or a .p7b (which means PKCS#7, which is the old name for CMS). The raw DER-encoded certificate is probably better supported than the CMS object, therefore I recommend using it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.