Skip to content

AIA CA Issuers

Jump to bottom
NeySlim edited this page Mar 26, 2026 · 1 revision

AIA CA Issuers (RFC 5280 §4.2.2.1)

The Authority Information Access (AIA) CA Issuers extension allows clients to download intermediate CA certificates for chain building during TLS verification.

Overview

When clients validate a TLS server certificate, they need the complete certificate chain from the end-entity certificate up to a trusted root. The AIA CA Issuers extension provides a URL where the issuing CA's certificate can be downloaded automatically.

How It Works

  1. Client receives a server certificate during TLS handshake
  2. Client reads the AIA CA Issuers URL from the certificate
  3. Client downloads the intermediate CA certificate from that URL
  4. Client builds the full chain and validates trust

Certificate Extension

Authority Information Access:
    OCSP - URI:http://your-server:8080/ocsp
    CA Issuers - URI:http://your-server:8080/ca/{ca_refid}.cer

Both OCSP and CA Issuers are part of the same AIA extension (OID 1.3.6.1.5.5.7.1.1).

Enabling AIA CA Issuers

Via UI

  1. Navigate to CRL/OCSP page in the sidebar
  2. Select a CA from the table
  3. In the detail panel, find the AIA CA Issuers section
  4. Toggle Enable AIA CA Issuers to ON
  5. The URL is auto-generated — copy it with the clipboard button
  6. All new certificates issued by this CA will include the AIA CA Issuers extension

Via API

# Check current status
curl -s https://your-server:8443/api/v2/cas/{ca_id} | jq '.data.aia_ca_issuers_enabled'

# Enable
curl -X PUT https://your-server:8443/api/v2/cas/{ca_id} \
  -H 'Content-Type: application/json' \
  -d '{"aia_ca_issuers_enabled": true}'

⚠️ Note: Enabling AIA CA Issuers only affects newly issued certificates. Existing certificates must be reissued to include the extension.

Public Download Endpoints

UCM serves CA certificates via public endpoints (no authentication required):

DER Format (.cer)

GET /ca/{ca_refid}.cer
  • Content-Type: application/pkix-cert
  • Cache-Control: public, max-age=86400
  • Preferred format for AIA extension
curl http://your-server:8080/ca/550e8400-e29b-41d4-a716-446655440000.cer -o ca.cer
openssl x509 -in ca.cer -inform DER -text -noout

PEM Format (.pem)

GET /ca/{ca_refid}.pem
  • Content-Type: application/x-pem-file
  • Cache-Control: public, max-age=86400 
curl http://your-server:8080/ca/550e8400-e29b-41d4-a716-446655440000.pem -o ca.pem

Legacy Numeric ID

Both endpoints also accept the legacy numeric CA ID:

curl http://your-server:8080/ca/1.cer
curl http://your-server:8080/ca/1.pem

HTTP Protocol Server

AIA CA Issuers URLs should use HTTP (not HTTPS) to avoid circular TLS dependencies. UCM serves these via the HTTP protocol server on port 8080 (same server used for CDP and OCSP).

http://your-server:8080/ca/{ca_refid}.cer    ← Recommended
https://your-server:8443/ca/{ca_refid}.cer   ← Also works

See CRL & CDP — HTTP Protocol Server for configuration details.

Verifying AIA in Certificates

Check Certificate Extensions

openssl x509 -in cert.pem -text -noout | grep -A 5 "Authority Information Access"

Expected output:

Authority Information Access:
    OCSP - URI:http://your-server:8080/ocsp
    CA Issuers - URI:http://your-server:8080/ca/550e8400-e29b-41d4-a716-446655440000.cer

Download and Verify CA Certificate

# Extract CA Issuers URL from certificate
AIA_URL=$(openssl x509 -in cert.pem -text -noout | grep "CA Issuers" | sed 's/.*URI://')

# Download CA certificate
curl -o issuer.cer "$AIA_URL"

# Verify chain
openssl verify -CAfile root-ca.pem -untrusted issuer.cer cert.pem

Comparison: CDP vs OCSP vs AIA CA Issuers

Feature CDP (CRL) OCSP AIA CA Issuers
Purpose Revocation list Real-time revocation CA certificate download
RFC RFC 5280 §4.2.1.13 RFC 6960 RFC 5280 §4.2.2.1
Endpoint /cdp/{refid}.crl /ocsp /ca/{refid}.cer
Protocol HTTP recommended HTTP recommended HTTP recommended
Authentication None (public) None (public) None (public)
Content Revoked serial numbers Single cert status CA certificate (DER/PEM)

💡 Best practice: Enable all three mechanisms on intermediate CAs for maximum client compatibility.

Troubleshooting

AIA CA Issuers URL Not Accessible

  • ✅ Verify firewall allows port 8080 (HTTP protocol server)
  • ✅ Test locally: curl http://localhost:8080/ca/{ca_refid}.cer
  • ✅ Check DNS resolution: nslookup your-server
  • ✅ In Docker, ensure -p 8080:8080 is set

Certificate Doesn't Include AIA Extension

  • ✅ AIA CA Issuers must be enabled before certificate issuance
  • ✅ Existing certificates don't get AIA extension (reissue required)
  • ✅ Verify in CA detail panel: CRL/OCSP → AIA CA Issuers → Enabled

Downloaded CA Certificate Is Invalid

  • ✅ Verify the CA has a certificate (crt field is not null)
  • ✅ Check endpoint returns correct content type: application/pkix-cert
  • ✅ Try PEM format if DER doesn't work: /ca/{refid}.pem

📚 Related Pages

Last Updated: 2026-03-26

Clone this wiki locally