While most documentation I've read states that there is no requirement to have the AIA extension in a self-signed Root certificate (logical enough), I can't find anything that tells me not to do so in the certificates issued by the Root. In fact, most examples I've found has the Root CA issuing certificates with an AIA extension pointing back to the Root CA.
RFC 5280 gives two possible options for AIA:
- the URL of the issuing CA's certificate.
- the URL of the OCSP responder.
For now, I'm ignoring OCSP, and assuming we have at least one subordinate CA.
What would be the point of having a
id-ad-caIssuers entry in the AIA extension within a certificate issued by the Root CA? If a subordinate needs to check this to find the path to the Root CA then it implies that the subordinate doesn't know about the Root CA's certificate and therefore doesn't have it in it's collection of Trust Anchors. A URL to the Root CA isn't going to change matters - it still won't trust it!
Am I correct or have I missed some point? If the latter, is there a situation where this AIA extension would be needed in a certificate issued by the Root CA?