Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

What file format is most appropriate or secure for the AIA record in a PKI certificate?

The options I'm aware of are:

  • DER encoded binary X.509 (.cer)
  • Base-64 encoded X.509 (.cer)

I also have the ability to save as .P7B but don't think that's a supported choice with AIA certs.

share|improve this question
This seems more appropriate for Server Fault. – Iszi Oct 12 '12 at 15:22
I posted here just because I thought the AIA record format is of significance to the IT Sec community. This isn't Windows-specific. Perhaps one format is more secure than the other? – makerofthings7 Oct 12 '12 at 15:24
@Iszi I disagree, he's not asking "how to create the .cer", he's asking which is a better choice, from a security PoV. On topic. – AviD♦ Oct 14 '12 at 8:17
1  
To @Iszi's credit, he is commenting on the first version of this post. I revised it to make it clearly on topic – makerofthings7 Oct 14 '12 at 14:22

1 Answer

up vote 1 down vote accepted

The Authority Information Access extension, which is added into certificates issued by a given CA, should contain a URL which points at a download location for the certificate of that said CA. This is described in section 4.2.2.1 of RFC 5280, in particular with this paragraph:

Where the information is available via HTTP or FTP, accessLocation MUST be a uniformResourceIdentifier and the URI MUST point to either a single DER encoded certificate as specified in [RFC2585] or a collection of certificates in a BER or DER encoded "certs-only" CMS message as specified in [RFC2797].

So that's either binary DER (not Base64), or a .p7b (which means PKCS#7, which is the old name for CMS). The raw DER-encoded certificate is probably better supported than the CMS object, therefore I recommend using it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.