I was not able to find anywhere in the RFCs which HTTP methods must be supported by the conformant CAs in order to allow users to download CRL.
What are the mandatory HTTP methods (GET, HEAD, ...) for CRL?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
RFC (to be precisely, RFC5280) doesn't define required protocols to be supported by CA for CRL/CRT download. It must be defined in a form supported by both, client and server. Thus, HTTP is not mandatory (though, recommended) at all. Major crypto clients (including CryptoAPI) use GET method to retrieve CRL/CRT files.