We have a private PKI with an offline root CA and an online intermediate CA. A device certificate's Authority Information Access (AIA) extension points to the intermediate CA certificate using a fully qualified domain name. However, the intermediate certificate's AIA points to the root CA certificate using only a hostname without the domain. A software vendor reports a vague error suggesting that the AIA may be missing or incorrect. The software is making an LDAP connection and appears to retrieve certificates and check revocation status, even though the root CA has not been manually imported. How important is the AIA on the intermediate certificate, and could the incomplete hostname be causing the problem?
3 Answers
AIA can help a system build a certificate chain when the issuer certificate is not already available, and it can also contain an OCSP responder URL. However, AIA is not a substitute for trusting the root CA. The root certificate should be installed in the device or application’s trusted root store through the appropriate management mechanism. A system should not automatically trust a root merely because it downloaded it through AIA.
The vendor should provide a more specific error, but it is worth correcting the certificates anyway. Use a fully qualified, reachable HTTP URL for the intermediate certificate in the leaf certificate’s AIA, and configure an appropriate OCSP or CRL distribution point. You can also publish the issuing certificates at a stable internal or externally reachable location, depending on the clients’ network access. Then verify that the LDAP client trusts the root and can retrieve the intermediate and revocation data without relying on DNS search-domain behavior.
For reliable chain building, install both the root and intermediate certificates wherever the LDAP client runs. The server should normally send the leaf certificate plus the intermediate certificate; the root is generally omitted because clients are expected to have it locally. The intermediate certificate’s AIA is often unnecessary when the chain is deployed correctly, but a URL containing only an unqualified hostname is still a poor configuration and may fail if the client cannot resolve it.
Exactly. AIA retrieval can be useful as a fallback, but it should not be relied on as the normal way to distribute a private CA chain.
That was my concern as well. The application seems to retrieve certificates and perform CRL checks for the LDAP connection, so I’m trying to determine whether the vendor is confusing chain building with establishing trust.