[stir] x5u

[Russ Housley <[e-mail]>]

RFC 5715 says:

4.1.5.  "x5u" (X.509 URL) Header Parameter

   The "x5u" (X.509 URL) Header Parameter is a URI [RFC3986] that refers
   to a resource for the X.509 public key certificate or certificate
   chain [RFC5280] corresponding to the key used to digitally sign the
   JWS.  The identified resource MUST provide a representation of the
   certificate or certificate chain that conforms to RFC 5280 [RFC5280]
   in PEM-encoded form, with each certificate delimited as specified in
   Section 6.1 of RFC 4945 [RFC4945].  The certificate containing the
   public key corresponding to the key used to digitally sign the JWS
   MUST be the first certificate.  This MAY be followed by additional
   certificates, with each subsequent certificate being the one used to
   certify the previous one.  The protocol used to acquire the resource
   MUST provide integrity protection; an HTTP GET request to retrieve
   the certificate MUST use TLS [RFC2818] [RFC5246]; and the identity of
   the server MUST be validated, as per Section 6 of RFC 6125 [RFC6125].
   Also, see Section 8 on TLS requirements.  Use of this Header
   Parameter is OPTIONAL.

And, RFC 4945 says:

6.1.  Certificates

   Certificates MUST be Base64 [19] encoded and appear between the
   following delimiters:

            -----BEGIN CERTIFICATE-----
            -----END CERTIFICATE-----

An example of a file that uses this encoding is here:

https://www.ietf.org/enc/verifybundle.pem

Russ