PKI - CDP and AIA paths, why must the URL be so complex?

Question

I'm currently desiging a new PKI infrastructure and thinking about the CPD and AIA extensions of the root and issuing CAs.
There is more than enough documention to find, but (almost) everyone is using the same kind of syntaxes to build the CDP and AIA urls. An AIA extension URL for example:
http://pki.fabrikam.com/CertEnroll/<ServerDNSName>_<CaName><CertificateName>.crt
This means that every issued certificate gets the following AIA URL in its extension:
http://pki.fabrikam.com/CertEnroll/myrootca_Fabrikam%20Ltd.%20Root%20Certification%20Authority.crt
I don't like this URL at all. First of all you expose the name of your CA server, second of all it contains illegal URL characters (.) and third of all, with the %20 in it (spaces) it looks ugly.
Is there any reason, why I just shouldn't skip all this variables and use the following name in the AIA/CDP extensions URL, e.g.:
http://pki.fabrikam.com/certenroll/contoso-rca.crt

Answer 1

On Fri, 24 Oct 2014 07:11:49 +0000, MD_1977 wrote:
I'm currently desiging a new PKI infrastructure and thinking about the CPD and AIA extensions of the root and issuing CAs.
There is more than enough documention to find, but (almost) everyone is using the same kind of syntaxes to build the CDP and AIA urls. An AIA extension URL for example:
http://pki.fabrikam.com/CertEnroll/<ServerDNSName>_<CaName><CertificateName>.crt
This means that every issued certificate gets the following AIA URL in its extension:
http://pki.fabrikam.com/CertEnroll/myrootca_Fabrikam%20Ltd.%20Root%20Certification%20Authority.crt
I don't like this URL at all. First of all you expose the name of your CA server, second of all it contains illegal URL characters (.) and third of all, with the %20 in it (spaces) it looks ugly.
Exposing the host name and CN of your CA is not a risk, and if you don't
want a "." in the URL, then don't use one when you create the CN for the CA
in the first place.
Is there any reason, why I just shouldn't skip all this variables and use the following name in the AIA/CDP extensions URL, e.g.:
http://pki.fabrikam.com/certenroll/contoso-rca.crt
There are a few reasons not to do this. First of all, the CA certificate
file name is always going to be
<ServerDNSName>_<CaName><CertificateName>.crt. Secondly, if you hard code
the CA certificate name in your URLs, you're going to run into problems
after renewals as there are index numbers added to the CA certificate file
name that you won't be able account for by hard coding the certificate
name.
Paul Adare - FIM CM MVP
void russian_roulette(void) { char *target; strcpy(target, "bullet"); }
-- Simon Cozens or Thorfinn