<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 10/29/16 7:44 AM, Cantor, Scott
wrote:<br>
</div>
<blockquote
cite="mid:9846A6064BD102419D06814DD0D78DE112A7A3BF@CIO-TNC-D2MBX02.osuad.osu.edu"
type="cite">
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
My guess is that maybe Windows' PKIX code might follow AIA extensions, but I would be surprised if anything else did. OpenSSL definitely does not, and unless I'm deeply mistaken, Java doesn't. </pre>
</blockquote>
<br>
Oracle Java can do it optionally. I remembered that they have a
system property you can set to turn it on, but IIRC in some previous
versions it only supported LDAP URLs, which is both a little odd and
also not very useful for most people. But looks like in 7 at least,
they support HTTP:<br>
<br>
<a class="moz-txt-link-freetext" href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/certpath/CertPathProgGuide.html#AIA">http://docs.oracle.com/javase/7/docs/technotes/guides/security/certpath/CertPathProgGuide.html#AIA</a><br>
<br>
<blockquote
cite="mid:9846A6064BD102419D06814DD0D78DE112A7A3BF@CIO-TNC-D2MBX02.osuad.osu.edu"
type="cite">
<pre wrap="">We would be pretty concerned about that sort of thing because once you start going HTTP GET operations, you introduce almost guaranteed concerns over timeout settings.</pre>
</blockquote>
<br>
Agreed. AFAIK it's off by default, so hopefully that lessens the
concern. I'm sure they probably use one of the standard internal
Java HTTP client mechanisms, and off-hand I don't know what kind of
timeouts those have. <br>
<br>
Since it has to be turned on explicitly, though, I doubt that this
is relevant to troubleshooting the OP's issue.<br>
<br>
<br>
</body>
</html>