3

What file format is most appropriate or secure for the AIA record in a PKI certificate?

The options I'm aware of are:

  • DER encoded binary X.509 (.cer)
  • Base-64 encoded X.509 (.cer)

I also have the ability to save as .P7B but don't think that's a supported choice with AIA certs.

4
  • This seems more appropriate for Server Fault.
    – Iszi
    Commented Oct 12, 2012 at 15:22
  • I posted here just because I thought the AIA record format is of significance to the IT Sec community. This isn't Windows-specific. Perhaps one format is more secure than the other? Commented Oct 12, 2012 at 15:24
  • @Iszi I disagree, he's not asking "how to create the .cer", he's asking which is a better choice, from a security PoV. On topic.
    – AviD
    Commented Oct 14, 2012 at 8:17
  • 1
    To @Iszi's credit, he is commenting on the first version of this post. I revised it to make it clearly on topic Commented Oct 14, 2012 at 14:22

1 Answer 1

3

The Authority Information Access extension, which is added into certificates issued by a given CA, should contain a URL which points at a download location for the certificate of that said CA. This is described in section 4.2.2.1 of RFC 5280, in particular with this paragraph:

Where the information is available via HTTP or FTP, accessLocation MUST be a uniformResourceIdentifier and the URI MUST point to either a single DER encoded certificate as specified in [RFC2585] or a collection of certificates in a BER or DER encoded "certs-only" CMS message as specified in [RFC2797].

So that's either binary DER (not Base64), or a .p7b (which means PKCS#7, which is the old name for CMS). The raw DER-encoded certificate is probably better supported than the CMS object, therefore I recommend using it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .