I was not able to find anywhere in the RFCs which HTTP methods must be supported by the conformant CAs in order to allow users to download CRL.

What are the mandatory HTTP methods (GET, HEAD, ...) for CRL?

  • 1
    Without deeper knowledge on this topic, downloading a CRL seems to imply GET. Also, this question may be on the brink of off-topic. – Richard Neumann Nov 30 '16 at 12:04

RFC (to be precisely, RFC5280) doesn't define required protocols to be supported by CA for CRL/CRT download. It must be defined in a form supported by both, client and server. Thus, HTTP is not mandatory (though, recommended) at all. Major crypto clients (including CryptoAPI) use GET method to retrieve CRL/CRT files.

  • RFC 5280 defines media type to be used by the HTTP server implementation. Why description of HTTP method is missed still not clear. Do you think it is a miss? – tysonite Dec 1 '16 at 6:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.