Consider adding support for retrieving intermediate certificates using the Authority Information Access (AIA) field of compatible certificates

[atc0005]

Overview

Currently this field (if available) is not used or emitted in certificate evaluation output.

As an example, this intermediate certificate specifies where to retrieve the certificate used to sign it:

InCommon RSA Server CA 2
	Authority Information Access
		Not Critical
		CA Issuers: URI: http://crt.usertrust.com/USERTrustRSAAAACA.crt
		OCSP Responder: URI: http://ocsp.usertrust.com

The last three lines indicate (subfields?) additional information, one line which provides a way to retrieve the next intermediate (or presumably root?) in the chain.

This field is new to me, so I don't know what support is available for parsing it, etc.

At a glance, some earlier intermediate and root certificates do not appear to include it.

References

• https://akamath32.medium.com/certificate-authority-information-access-aia-7bc56f7257fc
• https://en.wikipedia.org/wiki/X.509
• http://www.pkiglobe.org/auth_info_access.html

[atc0005]

Could be useful to provide a flag which indicates missing intermediate/root certificates from a cert pool should be retrieved (if possible) using the AIA CA Issuers subfield value.

[atc0005]

Additional references:

• https://security.stackexchange.com/questions/21513/which-cer-file-format-is-more-secure-for-purposes-of-an-aia-record
  • mentions suggested encoding format for certs
• http://www.pkiglobe.org/auth_info_access.html
  • mentions difference in encoding formats for different purposes
• https://serverfault.com/questions/437790/what-format-should-the-cer-file-have-in-the-aia-record-of-a-certificate
  • mentions DER format
• https://security.stackexchange.com/questions/73156/whats-the-difference-between-x-509-and-pkcs7-certificate
  • good info on cert formats
• https://akamath32.medium.com/certificate-authority-information-access-aia-7bc56f7257fc
  • the story/example sounds familiar

[atc0005]

PKCS7 support

Needed for processing some certificate bundles linked from AIA cert fields.

very brief glances over repos surfaced from pkg.go.dev search below.

https://pkg.go.dev/search?q=pkcs7&m=

---

https://github.com/cloudflare/cfssl
Mixed feelings re complexity
Might be pulling in a lot of dependencies

https://github.com/smallstep/pkcs7
Looks very promising
Presumably lighter on dependencies

https://pkg.go.dev/go.mozilla.org/pkcs7
https://github.com/mozilla-services/pkcs7
Ancestor of smallstep/pkcs7
Still seeing activity