Subject: Question on use of AIA extension

From: Juergen Brauckmann <[email-masked]>
Date: Thu, 06 Nov 2003 16:47:07 +0100

Hi.

I'm trying to understand the semantics of the Authority Info Access 
extension with id-ad-caIssuers access method. The wording in RFC3280 
seems to say that the accessLocation must point to any certificate in 
the cert chain that is at least two levels above the certificate which 
contains the AIA extension:

	"The id-ad-caIssuers OID is used when the additional information
	lists CAs that have issued certificates superior to the CA that
	issued the certificate containing this extension"

However, chapter 6.2 of draft-ietf-pkix-certpathbuild-01.txt states that 
an id-ad-caIssuers may point to a certificate for the issuer of the 
certificate containing the extension.

The question was already raised last year; it would be nice if someone 
could confirm which interpretation is correct.

Thanks a lot,
     Juergen

>     * To: "PKIX" <ietf-pkix@xxxxxxx>
>     * Subject: Question on use of AIA extension
>     * From: "Sarbari Gupta" <sarbari@xxxxxxxxxxxxxxxxxxx>
>     * Date: Fri, 22 Nov 2002 12:32:18 -0500
> 
> I was reviewing the description for the AIA extension in RFC 3280, and
> noticed the following text:
> 
> 	"The id-ad-caIssuers OID is used when the additional information
> 	lists CAs that have issued certificates superior to the CA that
> 	issued the certificate containing this extension"
> 
> The above seems to imply that the AIA extension (if populated) within an EE
> cert, should point to the "grandparent certificate" rather than the "parent
> certificate". Am I interpreting this correctly?
> 
> I was under the impression that CA vendors who make use of this extension
> (such as Microsoft) use the AIA extension to point to the "parent
> certificate". Is this consistent with the RFC 3280 specification?
> 
> Can someone please clarify.
> 
> ==============================
> Sarbari Gupta
> Electrosoft Services, Inc.
>