SC-104: Set presence of AIA extension to SHOULD for Subscriber Certificates.

[e3n0]

Summary

This ballot proposes making the Authority Information Access (AIA) extension a SHOULD instead of a MUST for Subscriber Certificates.

The Baseline Requirements currently:

• mandate the authorityInformationAccess extension (MUST) in the Subscriber Certificate Extensions table (Section 7.1.2.7.6); and
• require the AuthorityInfoAccessSyntax to contain one or more AccessDescriptions (Section 7.1.2.7.7).

Because the permissible accessMethods within the extension are both optional (id-ad-caIssuers is a SHOULD, and id-ad-ocsp is a MAY), Relying Parties (RPs) cannot depend on a particular accessMethod being present. Thus, it is reasonable to reduce the requirement for the AIA extension to a SHOULD as well.

Changes

This ballot makes two changes:

1. Subscriber Certificate Extensions Table: Replaces MUST with SHOULD for the presence of the authorityInformationAccess extension.
2. Section 7.1.2.7.7 (Subscriber Certificate Authority Information Access): Prepends the phrase "If present, " to the rule requiring that AuthorityInfoAccessSyntax contain one or more AccessDescriptions, reflecting that the extension is no longer mandatory.

Fixes #673