From de19a704ec56cfecee840344bc2b7ed1a87d4b0e Mon Sep 17 00:00:00 2001 From: Ethan Davis Date: Wed, 6 May 2026 19:33:12 +0000 Subject: [PATCH 1/5] Set presence of id-ad-caIssuers and AIA extension to MAY. --- docs/BR.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/BR.md b/docs/BR.md index 89e0d518..9a82c910 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -2299,7 +2299,7 @@ The `subject` MUST comply with the requirements of [Section 7.1.4](#714-name-for | `crlDistributionPoints` | MUST | N | See [Section 7.1.2.11.2](#712112-crl-distribution-points) | | `keyUsage` | MUST | Y | See [Section 7.1.2.10.7](#712107-ca-certificate-key-usage) | | `subjectKeyIdentifier` | MUST | N | See [Section 7.1.2.11.4](#712114-subject-key-identifier) | -| `authorityInformationAccess` | SHOULD | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | +| `authorityInformationAccess` | MAY | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | | `nameConstraints` | MAY | \*[^name_constraints] | See [Section 7.1.2.10.8](#712108-ca-certificate-name-constraints) | | Signed Certificate Timestamp List | MAY | N | See [Section 7.1.2.11.3](#712113-signed-certificate-timestamp-list) | | Any other extension | NOT RECOMMENDED | - | See [Section 7.1.2.11.5](#712115-other-extensions) | @@ -2811,14 +2811,14 @@ In addition, `subject` Attributes MUST NOT contain only metadata such as '.', '- ##### 7.1.2.7.7 Subscriber Certificate Authority Information Access -The `AuthorityInfoAccessSyntax` MUST contain one or more `AccessDescription`s. Each `AccessDescription` MUST only contain a permitted `accessMethod`, as detailed below, and each `accessLocation` MUST be encoded as the specified `GeneralName` type. +If the Authority Information Access extension is present, the `AuthorityInfoAccessSyntax` MUST contain one or more `AccessDescription`s. Each `AccessDescription` MUST only contain a permitted `accessMethod`, as detailed below, and each `accessLocation` MUST be encoded as the specified `GeneralName` type. The `AuthorityInfoAccessSyntax` MAY contain multiple `AccessDescription`s with the same `accessMethod`, if permitted for that `accessMethod`. When multiple `AccessDescription`s are present with the same `accessMethod`, each `accessLocation` MUST be unique, and each `AccessDescription` MUST be ordered in priority for that `accessMethod`, with the most-preferred `accessLocation` being the first `AccessDescription`. No ordering requirements are given for `AccessDescription`s that contain different `accessMethod`s, provided that previous requirement is satisfied. | **Access Method** | **Access Location** | **Presence** | **Maximum** | **Description** | | --- | ---- | - | - | --- | | `id-ad-ocsp` (OID: 1.3.6.1.5.5.7.48.1) | `uniformResourceIdentifier` | MAY | \* | A HTTP URL of the Issuing CA's OCSP responder. | -| `id-ad-caIssuers` (OID: 1.3.6.1.5.5.7.48.2) | `uniformResourceIdentifier` | SHOULD | \* | A HTTP URL of the Issuing CA's certificate. | +| `id-ad-caIssuers` (OID: 1.3.6.1.5.5.7.48.2) | `uniformResourceIdentifier` | MAY | \* | A HTTP URL of the Issuing CA's certificate. | | Any other value | - | MUST NOT | - | No other `accessMethod`s may be used. | ##### 7.1.2.7.8 Subscriber Certificate Basic Constraints From a5ae9a3ff196d56f39143a64d4ce62ebe290b1e9 Mon Sep 17 00:00:00 2001 From: Ethan Davis Date: Wed, 6 May 2026 19:41:10 +0000 Subject: [PATCH 2/5] Update AIA to may in 7.1.2.7.6. --- docs/BR.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/BR.md b/docs/BR.md index 9a82c910..52b095b9 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -2791,7 +2791,7 @@ In addition, `subject` Attributes MUST NOT contain only metadata such as '.', '- | **Extension** | **Presence** | **Critical** | **Description** | | --------------------------------- | ----------- | ------------ | -------------------------------------- | -| `authorityInformationAccess` | MUST | N | See [Section 7.1.2.7.7](#71277-subscriber-certificate-authority-information-access) | +| `authorityInformationAccess` | MAY | N | See [Section 7.1.2.7.7](#71277-subscriber-certificate-authority-information-access) | | `authorityKeyIdentifier` | MUST | N | See [Section 7.1.2.11.1](#712111-authority-key-identifier) | | `certificatePolicies` | MUST | N | See [Section 7.1.2.7.9](#71279-subscriber-certificate-certificate-policies) | | `extKeyUsage` | MUST | N | See [Section 7.1.2.7.10](#712710-subscriber-certificate-extended-key-usage) | From 56dd62195fdf49d9d6eb5c3713960f7d573b5a71 Mon Sep 17 00:00:00 2001 From: Ethan Davis Date: Wed, 6 May 2026 19:51:24 +0000 Subject: [PATCH 3/5] Update AIA to MAY for other certificates as well. --- docs/BR.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/BR.md b/docs/BR.md index 52b095b9..7e289804 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -2443,7 +2443,7 @@ This Certificate Profile MAY be used when issuing a CA Certificate that will be | `keyUsage` | MUST | Y | See [Section 7.1.2.10.7](#712107-ca-certificate-key-usage) | | `subjectKeyIdentifier` | MUST | N | See [Section 7.1.2.11.4](#712114-subject-key-identifier) | | `extKeyUsage` | MUST[^eku_ca] | N | See [Section 7.1.2.3.3](#71233-technically-constrained-non-tls-subordinate-ca-extended-key-usage)| -| `authorityInformationAccess` | SHOULD | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | +| `authorityInformationAccess` | MAY | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | | `certificatePolicies` | MAY | N | See [Section 7.1.2.3.2](#71232-technically-constrained-non-tls-subordinate-ca-certificate-policies) | | `nameConstraints` | MAY | \*[^name_constraints] | See [Section 7.1.2.10.8](#712108-ca-certificate-name-constraints) | | Signed Certificate Timestamp List | MAY | N | See [Section 7.1.2.11.3](#712113-signed-certificate-timestamp-list) | @@ -2530,7 +2530,7 @@ Effective 2026-03-15: | `keyUsage` | MUST | Y | See [Section 7.1.2.10.7](#712107-ca-certificate-key-usage) | | `subjectKeyIdentifier` | MUST | N | See [Section 7.1.2.11.4](#712114-subject-key-identifier) | | `extKeyUsage` | MUST[^eku_ca] | N | See [Section 7.1.2.4.2](#71242-technically-constrained-precertificate-signing-ca-extended-key-usage) | -| `authorityInformationAccess` | SHOULD | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | +| `authorityInformationAccess` | MAY | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | | `nameConstraints` | MAY | \*[^name_constraints] | See [Section 7.1.2.10.8](#712108-ca-certificate-name-constraints) | | Signed Certificate Timestamp List | MAY | N | See [Section 7.1.2.11.3](#712113-signed-certificate-timestamp-list) | | Any other extension | NOT RECOMMENDED | - | See [Section 7.1.2.11.5](#712115-other-extensions) | @@ -2574,7 +2574,7 @@ This Certificate Profile MAY be used when issuing a CA Certificate that will be | `subjectKeyIdentifier` | MUST | N | See [Section 7.1.2.11.4](#712114-subject-key-identifier) | | `extKeyUsage` | MUST[^eku_ca] | N | See [Section 7.1.2.10.6](#712106-ca-certificate-extended-key-usage) | | `nameConstraints` | MUST | \*[^name_constraints] | See [Section 7.1.2.5.2](#71252-technically-constrained-tls-subordinate-ca-name-constraints) | -| `authorityInformationAccess` | SHOULD | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | +| `authorityInformationAccess` | MAY | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | | Signed Certificate Timestamp List | MAY | N | See [Section 7.1.2.11.3](#712113-signed-certificate-timestamp-list) | | Any other extension | NOT RECOMMENDED | - | See [Section 7.1.2.11.5](#712115-other-extensions) | @@ -2648,7 +2648,7 @@ CAs SHALL NOT include additional names unless the CA is aware of a reason for in | `keyUsage` | MUST | Y | See [Section 7.1.2.10.7](#712107-ca-certificate-key-usage) | | `subjectKeyIdentifier` | MUST | N | See [Section 7.1.2.11.4](#712114-subject-key-identifier) | | `extKeyUsage` | MUST[^eku_ca] | N | See [Section 7.1.2.10.6](#712106-ca-certificate-extended-key-usage) | -| `authorityInformationAccess` | SHOULD | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | +| `authorityInformationAccess` | MAY | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | | `nameConstraints` | MAY | \*[^name_constraints] | See [Section 7.1.2.10.8](#712108-ca-certificate-name-constraints) | | Signed Certificate Timestamp List | MAY | N | See [Section 7.1.2.11.3](#712113-signed-certificate-timestamp-list) | | Any other extension | NOT RECOMMENDED | - | See [Section 7.1.2.11.5](#712115-other-extensions) | @@ -2811,7 +2811,7 @@ In addition, `subject` Attributes MUST NOT contain only metadata such as '.', '- ##### 7.1.2.7.7 Subscriber Certificate Authority Information Access -If the Authority Information Access extension is present, the `AuthorityInfoAccessSyntax` MUST contain one or more `AccessDescription`s. Each `AccessDescription` MUST only contain a permitted `accessMethod`, as detailed below, and each `accessLocation` MUST be encoded as the specified `GeneralName` type. +If present, the `AuthorityInfoAccessSyntax` MUST contain one or more `AccessDescription`s. Each `AccessDescription` MUST only contain a permitted `accessMethod`, as detailed below, and each `accessLocation` MUST be encoded as the specified `GeneralName` type. The `AuthorityInfoAccessSyntax` MAY contain multiple `AccessDescription`s with the same `accessMethod`, if permitted for that `accessMethod`. When multiple `AccessDescription`s are present with the same `accessMethod`, each `accessLocation` MUST be unique, and each `AccessDescription` MUST be ordered in priority for that `accessMethod`, with the most-preferred `accessLocation` being the first `AccessDescription`. No ordering requirements are given for `AccessDescription`s that contain different `accessMethod`s, provided that previous requirement is satisfied. From 621a3c4d3480738cfc0f1ab81cca8890d98343bb Mon Sep 17 00:00:00 2001 From: Ethan Davis Date: Wed, 6 May 2026 20:09:15 +0000 Subject: [PATCH 4/5] Limit change to AIA to subscriber certificates. --- docs/BR.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/BR.md b/docs/BR.md index 7e289804..aa178ce2 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -2299,7 +2299,7 @@ The `subject` MUST comply with the requirements of [Section 7.1.4](#714-name-for | `crlDistributionPoints` | MUST | N | See [Section 7.1.2.11.2](#712112-crl-distribution-points) | | `keyUsage` | MUST | Y | See [Section 7.1.2.10.7](#712107-ca-certificate-key-usage) | | `subjectKeyIdentifier` | MUST | N | See [Section 7.1.2.11.4](#712114-subject-key-identifier) | -| `authorityInformationAccess` | MAY | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | +| `authorityInformationAccess` | SHOULD | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | | `nameConstraints` | MAY | \*[^name_constraints] | See [Section 7.1.2.10.8](#712108-ca-certificate-name-constraints) | | Signed Certificate Timestamp List | MAY | N | See [Section 7.1.2.11.3](#712113-signed-certificate-timestamp-list) | | Any other extension | NOT RECOMMENDED | - | See [Section 7.1.2.11.5](#712115-other-extensions) | @@ -2443,7 +2443,7 @@ This Certificate Profile MAY be used when issuing a CA Certificate that will be | `keyUsage` | MUST | Y | See [Section 7.1.2.10.7](#712107-ca-certificate-key-usage) | | `subjectKeyIdentifier` | MUST | N | See [Section 7.1.2.11.4](#712114-subject-key-identifier) | | `extKeyUsage` | MUST[^eku_ca] | N | See [Section 7.1.2.3.3](#71233-technically-constrained-non-tls-subordinate-ca-extended-key-usage)| -| `authorityInformationAccess` | MAY | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | +| `authorityInformationAccess` | SHOULD | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | | `certificatePolicies` | MAY | N | See [Section 7.1.2.3.2](#71232-technically-constrained-non-tls-subordinate-ca-certificate-policies) | | `nameConstraints` | MAY | \*[^name_constraints] | See [Section 7.1.2.10.8](#712108-ca-certificate-name-constraints) | | Signed Certificate Timestamp List | MAY | N | See [Section 7.1.2.11.3](#712113-signed-certificate-timestamp-list) | @@ -2530,7 +2530,7 @@ Effective 2026-03-15: | `keyUsage` | MUST | Y | See [Section 7.1.2.10.7](#712107-ca-certificate-key-usage) | | `subjectKeyIdentifier` | MUST | N | See [Section 7.1.2.11.4](#712114-subject-key-identifier) | | `extKeyUsage` | MUST[^eku_ca] | N | See [Section 7.1.2.4.2](#71242-technically-constrained-precertificate-signing-ca-extended-key-usage) | -| `authorityInformationAccess` | MAY | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | +| `authorityInformationAccess` | SHOULD | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | | `nameConstraints` | MAY | \*[^name_constraints] | See [Section 7.1.2.10.8](#712108-ca-certificate-name-constraints) | | Signed Certificate Timestamp List | MAY | N | See [Section 7.1.2.11.3](#712113-signed-certificate-timestamp-list) | | Any other extension | NOT RECOMMENDED | - | See [Section 7.1.2.11.5](#712115-other-extensions) | @@ -2574,7 +2574,7 @@ This Certificate Profile MAY be used when issuing a CA Certificate that will be | `subjectKeyIdentifier` | MUST | N | See [Section 7.1.2.11.4](#712114-subject-key-identifier) | | `extKeyUsage` | MUST[^eku_ca] | N | See [Section 7.1.2.10.6](#712106-ca-certificate-extended-key-usage) | | `nameConstraints` | MUST | \*[^name_constraints] | See [Section 7.1.2.5.2](#71252-technically-constrained-tls-subordinate-ca-name-constraints) | -| `authorityInformationAccess` | MAY | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | +| `authorityInformationAccess` | SHOULD | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | | Signed Certificate Timestamp List | MAY | N | See [Section 7.1.2.11.3](#712113-signed-certificate-timestamp-list) | | Any other extension | NOT RECOMMENDED | - | See [Section 7.1.2.11.5](#712115-other-extensions) | @@ -2648,7 +2648,7 @@ CAs SHALL NOT include additional names unless the CA is aware of a reason for in | `keyUsage` | MUST | Y | See [Section 7.1.2.10.7](#712107-ca-certificate-key-usage) | | `subjectKeyIdentifier` | MUST | N | See [Section 7.1.2.11.4](#712114-subject-key-identifier) | | `extKeyUsage` | MUST[^eku_ca] | N | See [Section 7.1.2.10.6](#712106-ca-certificate-extended-key-usage) | -| `authorityInformationAccess` | MAY | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | +| `authorityInformationAccess` | SHOULD | N | See [Section 7.1.2.10.3](#712103-ca-certificate-authority-information-access) | | `nameConstraints` | MAY | \*[^name_constraints] | See [Section 7.1.2.10.8](#712108-ca-certificate-name-constraints) | | Signed Certificate Timestamp List | MAY | N | See [Section 7.1.2.11.3](#712113-signed-certificate-timestamp-list) | | Any other extension | NOT RECOMMENDED | - | See [Section 7.1.2.11.5](#712115-other-extensions) | From d3fc0334b58a5f0821a4de651e554dcf06db949e Mon Sep 17 00:00:00 2001 From: Ethan Davis Date: Mon, 29 Jun 2026 18:15:27 +0000 Subject: [PATCH 5/5] Update to make AIA SHOULD, keep caIssuers a SHOULD. --- docs/BR.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/BR.md b/docs/BR.md index aa178ce2..b1efebc6 100644 --- a/docs/BR.md +++ b/docs/BR.md @@ -2791,7 +2791,7 @@ In addition, `subject` Attributes MUST NOT contain only metadata such as '.', '- | **Extension** | **Presence** | **Critical** | **Description** | | --------------------------------- | ----------- | ------------ | -------------------------------------- | -| `authorityInformationAccess` | MAY | N | See [Section 7.1.2.7.7](#71277-subscriber-certificate-authority-information-access) | +| `authorityInformationAccess` | SHOULD | N | See [Section 7.1.2.7.7](#71277-subscriber-certificate-authority-information-access) | | `authorityKeyIdentifier` | MUST | N | See [Section 7.1.2.11.1](#712111-authority-key-identifier) | | `certificatePolicies` | MUST | N | See [Section 7.1.2.7.9](#71279-subscriber-certificate-certificate-policies) | | `extKeyUsage` | MUST | N | See [Section 7.1.2.7.10](#712710-subscriber-certificate-extended-key-usage) | @@ -2818,7 +2818,7 @@ The `AuthorityInfoAccessSyntax` MAY contain multiple `AccessDescription`s with t | **Access Method** | **Access Location** | **Presence** | **Maximum** | **Description** | | --- | ---- | - | - | --- | | `id-ad-ocsp` (OID: 1.3.6.1.5.5.7.48.1) | `uniformResourceIdentifier` | MAY | \* | A HTTP URL of the Issuing CA's OCSP responder. | -| `id-ad-caIssuers` (OID: 1.3.6.1.5.5.7.48.2) | `uniformResourceIdentifier` | MAY | \* | A HTTP URL of the Issuing CA's certificate. | +| `id-ad-caIssuers` (OID: 1.3.6.1.5.5.7.48.2) | `uniformResourceIdentifier` | SHOULD | \* | A HTTP URL of the Issuing CA's certificate. | | Any other value | - | MUST NOT | - | No other `accessMethod`s may be used. | ##### 7.1.2.7.8 Subscriber Certificate Basic Constraints