Authority Information Access (AIA)

AIA, defined in RFC 5280, holds access descriptions of two kinds: caIssuers, a URL from which the certificate of the CA that signed this certificate can be downloaded, and ocsp, the URL of that CA's OCSP responder. The URLs are normally plain HTTP. That is deliberate: the data fetched is signed and verified on its own, and requiring HTTPS would create a circular dependency on certificate validation.

Why it matters

Some platforms, including the certificate verifier built into Windows, use the caIssuers URL to download a missing intermediate certificate by themselves, a behaviour called AIA fetching or chasing. OpenSSL-based tools, curl and many mobile and embedded clients do not, which is why a server with an incomplete chain can look fine in one browser and fail elsewhere. The OCSP part is shrinking: Ballot SC-063 (effective 2024-03-15) made OCSP optional for CAs, and Let's Encrypt removed OCSP URLs from new certificates on 2025-05-07, relying on CRLs for revocation instead.

Example

openssl x509 -in cert.pem -noout -ext authorityInfoAccess

Authority Information Access:
    CA Issuers - URI:http://ca.example.com/issuer.crt

Common misconceptions

• AIA means you can skip sending intermediates. Many clients never fetch them; always serve the full chain.
• AIA URLs should use HTTPS. Plain HTTP is intentional; the downloaded certificate is checked by its signature, not by the transport.