# What Is Authority Information Access (AIA)?

> Authority Information Access (AIA) is the X.509 extension giving URLs for the issuing CA's certificate and, optionally, the CA's OCSP responder.

Source: https://ssl.sh/glossary/aia/
Last updated: 2026-11-10

AIA, defined in RFC 5280, holds access descriptions of two kinds: `caIssuers`, a URL from which the certificate of the CA that signed this certificate can be downloaded, and `ocsp`, the URL of that CA's [OCSP](https://ssl.sh/glossary/ocsp/) responder. The URLs are normally plain HTTP. That is deliberate: the data fetched is signed and verified on its own, and requiring HTTPS would create a circular dependency on certificate validation.

## Why it matters
Some platforms, including the certificate verifier built into Windows, use the caIssuers URL to download a missing [intermediate certificate](https://ssl.sh/glossary/intermediate-certificate/) by themselves, a behaviour called AIA fetching or chasing. OpenSSL-based tools, curl and many mobile and embedded clients do not, which is why a server with an incomplete chain can look fine in one browser and fail elsewhere. The OCSP part is shrinking: Ballot SC-063 (effective 2024-03-15) made OCSP optional for CAs, and Let's Encrypt removed OCSP URLs from new certificates on 2025-05-07, relying on [CRLs](https://ssl.sh/glossary/crl/) for revocation instead.

## Example
```bash
openssl x509 -in cert.pem -noout -ext authorityInfoAccess
```

```text
Authority Information Access:
    CA Issuers - URI:http://ca.example.com/issuer.crt
```

## Common misconceptions
- **AIA means you can skip sending intermediates.** Many clients never fetch them; always serve the full chain.
- **AIA URLs should use HTTPS.** Plain HTTP is intentional; the downloaded certificate is checked by its signature, not by the transport.

## Related terms

- [中间证书](https://ssl.sh/zh/glossary/intermediate-certificate/): 中间证书是由根证书（或上级中间证书）签发、用来签发网站证书的 CA 证书，服务器必须把它和网站证书一起发送给客户端。
- [OCSP](https://ssl.sh/zh/glossary/ocsp/): OCSP 是 RFC 6960 定义的在线证书状态协议，客户端可以向 CA 的响应服务器查询某一张证书当前是有效、已吊销还是未知。
- [证书链](https://ssl.sh/zh/glossary/certificate-chain/): 证书链是从网站终端证书经中间证书一直到受信任根证书的有序证书序列，每一张都由下一张签名。
- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [CRL](https://ssl.sh/zh/glossary/crl/): CRL 是由 CA 签名并定期重新发布的证书吊销列表，列出它在证书到期前就已吊销的证书序列号。
- [证书吊销](https://ssl.sh/zh/glossary/revocation/): 证书吊销是 CA 在证书到期前宣布其作废的操作，通过 CRL 或 OCSP 对外公布，使客户端不再信任这张证书。