add support for Authority Information Access (AIA) #13776

milahu · 2024-05-25T10:27:22Z

milahu
May 25, 2024

web servers will still need to include all the certificates (source)

no. since we cannot force admins to fix their servers for strict RFC compliance,
we need fault-tolerant clients.
AIA is simply a missing feature in curl and python and other clients

similar: we cannot force admins to return valid html, so we need loose html parsers

python issue: python/cpython#62817
python workaround: ~~danilobellini/aia~~ jponf/aia-chaser

continue #2793

Example site that uses certificate with AIA extension:
$ curl --version
curl 7.39.0 (x86_64-pld-linux-gnu) libcurl/7.39.0 OpenSSL/1.0.1j zlib/1.2.8 c->ares/1.10.0 libidn/1.29 libssh2/1.4.3 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp >rtsp scp sftp smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile GSS-API SPNEGO NTLM NTLM_WB SSL libz TLS-SRP >Metalink

$ curl --cacert /etc/certs/ca-certificates.crt https://ftp.ruby-lang.org/
curl: (60) SSL certificate problem: unable to get local issuer certificate
If you try the same URL with firefox or google chrome then certificate will be validated fine. That's because these browsers look into AIA and fetch intermediate certificate found there:
$ openssl s_client -host ftp.ruby-lang.org -port 443 2>&1 | openssl x509 -in >/dev/stdin -text | grep -A3 "Authority Informa"
Authority Information Access:
CA Issuers - >URI:http://secure.globalsign.com/cacert/gsdomainvalsha2g2r1.crt
OCSP - URI:http://ocsp2.globalsign.com/gsdomainvalsha2g2
curl could do similar thing to firefox/google-chrome and fetch that intermediate gsdomainvalsha2g2r1.crt cert thus allowing validation to pass.

bagder · 2024-05-26T21:19:09Z

bagder
May 26, 2024
Maintainer

This feature has been mentioned in the TODO since commit 1fb8048

0 replies

wheelerlaw · 2025-10-01T17:18:07Z

wheelerlaw
Oct 1, 2025

Whether or not curl handles AIA extensions depends on which SSL library curl was compiled with. For example:

curl 8.7.1 that is compiled against LibreSSL 3.3.6, it supports fetching certificates using the AIA extensions:

% curl --version
curl 8.7.1 (x86_64-apple-darwin24.0) libcurl/8.7.1 (SecureTransport) LibreSSL/3.3.6 zlib/1.2.12 nghttp2/1.64.0
Release-Date: 2024-03-27
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS GSS-API HSTS HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz MultiSSL NTLM SPNEGO SSL threadsafe UnixSockets

% curl -vs https://crl.nit.disa.mil/crl/DODJITCROOTCA3.crl            
* Host crl.nit.disa.mil:443 was resolved.
* IPv6: (none)
* IPv4: 198.154.72.177
*   Trying 198.154.72.177:443...
* Connected to crl.nit.disa.mil (198.154.72.177) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-AES256-GCM-SHA384 / [blank] / UNDEF
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: C=US; ST=Maryland; L=Fort Meade; O=DEFENSE INFORMATION SYSTEMS AGENCY; CN=gds-web-test01.c3pki.nit.disa.mil
*  start date: Dec 12 17:09:43 2024 GMT
*  expire date: Jan  3 17:08:43 2026 GMT
*  subjectAltName: host "crl.nit.disa.mil" matched cert's "crl.nit.disa.mil"
*  issuer: C=US; O=IdenTrust; OU=TrustID Server; CN=TrustID Server CA O1
*  SSL certificate verify ok.
* using HTTP/1.x
> GET /crl/DODJITCROOTCA3.crl HTTP/1.1
> Host: crl.nit.disa.mil
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 200 200
< Date: Wed, 01 Oct 2025 17:15:39 GMT
< Server: Apache
< Set-Cookie: gdscrl=expiry=1759339539634514;Max-Age=600;httpOnly Secure
< Content-Disposition: attachment; filename="DODJITCROOTCA3.crl"
< Accept-Ranges: bytes
< ETag: "B2D98726384291B3054D8D15340B30CFEA7A8F2A"
< Last-Modified: Fri, 26 Sep 2025 15:48:42 GMT
< Expires: Mon, 27 Oct 2025 15:48:42 GMT
< Cache-Control: max-age=246530,s-maxage=89647,public,no-transform,must-revalidate,proxy-revalidate
< Edge-control: cache-maxage=89647s
< Content-Type: application/pkix-crl
< Content-Length: 834
< Set-Cookie: gdscrl=expiry=1759339539634514;Max-Age=600;httpOnly Secure
<

But using Homebrew's curl that is compiled against OpenSSL 3.5.2 does not handle the AIA extensions:

% /opt/homebrew/opt/curl/bin/curl --version              
curl 8.16.0 (aarch64-apple-darwin24.4.0) libcurl/8.16.0 OpenSSL/3.5.2 zlib/1.2.12 brotli/1.1.0 zstd/1.5.7 AppleIDN libssh2/1.11.1 nghttp2/1.67.1 ngtcp2/1.16.0 nghttp3/1.12.0 librtmp/2.3
Release-Date: 2025-09-10
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtmp rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd
% /opt/homebrew/opt/curl/bin/curl -vs https://crl.nit.disa.mil/crl/DODJITCROOTCA3.crl
* Host crl.nit.disa.mil:443 was resolved.
* IPv6: (none)
* IPv4: 198.154.72.177
*   Trying 198.154.72.177:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* closing connection #0

5 replies

bagder Oct 1, 2025
Maintainer

Is that LibreSSL/3.3.6 version the one Apple themselves ship that the bundled curl uses?

jay Oct 2, 2025
Maintainer

That server is misconfigured, it is not sending the intermediate as required.

Certificate chain
 0 s:C = US, ST = Maryland, L = Fort Meade, O = DEFENSE INFORMATION SYSTEMS AGENCY, CN = gds-web-test01.c3pki.nit.disa.mil
   i:C = US, O = IdenTrust, OU = TrustID Server, CN = TrustID Server CA O1
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Dec 12 17:09:43 2024 GMT; NotAfter: Jan  3 17:08:43 2026 GMT
---

icing Oct 2, 2025
Collaborator

When using Apple SecTrust (from #18703), the url works.

bagder Oct 2, 2025
Maintainer

So isn't this just the macOS native LibreSSL version that uses the Apple SecTrust?

jay Oct 2, 2025
Maintainer

IIRC Schannel also fetches AIA, but regardless that server is misconfigured

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

add support for Authority Information Access (AIA) #13776

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments 5 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

add support for Authority Information Access (AIA) #13776

Uh oh!

Uh oh!

milahu May 25, 2024

Replies: 2 comments · 5 replies

Uh oh!

bagder May 26, 2024 Maintainer

Uh oh!

wheelerlaw Oct 1, 2025

Uh oh!

bagder Oct 1, 2025 Maintainer

Uh oh!

jay Oct 2, 2025 Maintainer

Uh oh!

icing Oct 2, 2025 Collaborator

Uh oh!

bagder Oct 2, 2025 Maintainer

Uh oh!

jay Oct 2, 2025 Maintainer

milahu
May 25, 2024

Replies: 2 comments 5 replies

bagder
May 26, 2024
Maintainer

wheelerlaw
Oct 1, 2025

bagder Oct 1, 2025
Maintainer

jay Oct 2, 2025
Maintainer

icing Oct 2, 2025
Collaborator

bagder Oct 2, 2025
Maintainer

jay Oct 2, 2025
Maintainer