What is AIA (Authority Information Access)?

Short answer

AIA (Authority Information Access) is the X.509 extension inside a certificate that shows where the information about the CA that signed it can be reached (RFC 5280): it carries the address from which the certificate of the signing CA is downloaded (CA Issuers) and the OCSP address where the status of the certificate is queried. Some clients that encounter a certificate sent with an incomplete chain complete the chain themselves by downloading the missing intermediate certificate from this address. In TR7, while the missing link is searched for with Suggest Completion on the Chain tab of the certificate preview, if Also try downloading from the issuer's address (AIA) is selected, the missing certificate is also downloaded from the AIA address; only the candidates that pass the signature validation are suggested.

Where It Is Used in TR7

Where	Field / label	What for
Certificates & PKI → SSL/TLS Certificates → preview → Chain	Suggest Completion → Also try downloading from the issuer's address (AIA)	Searching for the missing intermediate certificate in the other records and in the CA records, and, if selected, at the AIA address; the source of the suggestion is written as downloaded (AIA)
Chain tab	Add to this certificate's chain	Adding the certificates found to the chain content of the record; applied only in Manual and PFX records
Certificates & PKI → TLS Security Profiles	OCSP Stapling	The OCSP address needed for OCSP Stapling is carried in the AIA extension of the certificate

The download is done by the TR7 device; if the AIA address cannot be fetched, the The issuer's address (AIA) could not be fetched message is shown.

Common Misconceptions

• "Thanks to AIA, there is no need to add the chain." Not every client downloads from AIA; API clients and many mobile applications do not. The intermediate certificate is added to the chain on the server side (How do I tell if the certificate chain is incomplete?).
• "Every certificate downloaded from AIA is added to the chain." TR7 suggests only the candidates that pass the signature validation; the addition is made when it is confirmed with Add to this certificate's chain.
• "Every certificate carries AIA." AIA is an optional extension; it is common in the certificates of public CAs and may not be present in the certificates of corporate CAs.

How it is done in the documentation

• SSL/TLS Certificates · Chain Tab
• SSL/TLS Certificates · The Certificate Chain

Related questions

• How do I tell if the certificate chain is incomplete?
• How do I add the intermediate certificate chain?
• What is a certificate chain?
• What are OCSP and OCSP Stapling?