Downloading things from the AIA fields would mean triggering HTTP/HTTPS requests to an untrusted URL from a certificate you haven't verified - not a good idea. What firefox does is cache intermediates that it has seen elsewhere, the windows TLS stack can fetch additional certs from windows update on-demand (and actually starts with only a small bundle of trusted roots). There is no good solution for incomplete chains other than getting the sites fixed (or using a provider like cloudflare that solves it for them).
1. A SYN will receive a SYN-ACK or a RST
2. A host from my machine is the same as from your machine
3. An IP from my machine is the same as from your machine
It was also possible in earlier browsers by using hidden frames. User interaction or a timer would trigger, then you load the frame (which contained dynamically generated js) and then call the javascript you'd just loaded.
You can't get perfection, but you can do things like ask for them to document the controls they implement and to evidence that they have operated them appropriately via an audit like SOC2.
If you care about performance then you should start by reading High Performance
Browser Networking (the text is available online here https://hpbn.co/ ).
reply