Why must the OCSP URL be added to the CA's Authority Information Access (AIA) extension before it issues any certificates, and why is a typo there so costly?
The CA copies the AIA URLs into every certificate it issues, so clients learn where to ask from the certificate itself; a wrong URL is baked into all certificates and cannot be fixed afterwards.
A verifier that holds a certificate needs to know where to check its status. The only reliable place to tell it is inside the certificate. Two extensions carry that information:
- CRL Distribution Points (CDP): where to download the CRL.
- Authority Information Access (AIA): where to fetch the issuer's certificate (for chain building) and, with "Include in the online certificate status protocol (OCSP) extension" ticked, the OCSP responder URL, e.g.
http://ws-001.g001.ckteck.com/ocsp.
The CA writes these URLs into each certificate at issue time, and a certificate is signed, so it cannot be edited later. If the URL has a wrong host or group number, every certificate already issued points to a responder that does not exist. OCSP checks against them fail, and the only cure is to correct the setting and reissue every certificate. That is why this step comes before the CA ever starts.
Go deeper:
RFC 5280: X.509 PKI Certificate and CRL Profile — section 4.2.2.1 defines Authority Information Access, including the id-ad-ocspaccess method.- Wikipedia: Online Certificate Status Protocol — how clients find and query the responder.