We're almost ready to issue certificates for IP address SANs from Let's Encrypt's production environment. They'll only be available under the shortlived profile (which has a 6-day validity period), and that profile will remain allowlist-only for a while. Please note: We have more work to do before …

[image] JamesLE: https://[2602:ff3a:1:abad:c0f:fee:abad:cafe]/ Lol, also a bug in Discourse I guess? The URL is blue, but it's just a <a>...</a> without the href= part et cetera.. So an anchor, yes, but hyperlink? No.. Anyway, gotta get myself on that shortlived profile somehow …

It should be an IP SAN type. This would be IP.# in OpenSSL, not DNS.#. A related post: [image] SSL certificate with IP in the SAN General Hi, I issued an SSL certificate with and FQN, hostname and IP in the Subject Alternativ…

[image] Osiris: Lol, also a bug in Discourse I guess? The URL is blue, but it's just a <a>...</a> without the href= part et cetera.. So an anchor, yes, but hyperlink? No.. Oof! That does look like a Discourse limitation. [image] Osiris: How can I make my browser NOT follow the 302 redire…

Is the underlying SAN specifically coded as IP type? I haven't dug around in it. I noticed my guarding code in my overhaul of CertSage recently, which is why this came to mind.

It should be, and my own inspection confirms that it is, but that's why we're asking other folks to take a look!

I shudder to think of the amount of hardcoded software that will soon be tripping over this (not actually) new concept. :woozy_face:

Decoded Certificate: Data: Version: 3 (0x2) Serial Number: 2c:64:98:a5:1c:55:e9:6f:74:94:17:be:70:6c:1b:d1:62:a2 Signature Algorithm: ecdsa-with-SHA384 Issuer: C=US, O=(STAGING) Let's Encrypt, CN=(STAGING) False Fennel E6 Validity …

[image] JamesLE: They are similar, but look closely: one is definitely a DNS name and one is definitely an IPv6 address. Dang, just saw the dots vs. colons after looking at it for 5 extra minutes :rofl: Even though I already figured it was a valid FQDN, I didn't notice thát difference.

[image] JamesLE: abad.cafe I want to get a coffee there. :hot_beverage:

Getting ready to issue IP address certificates

Issuance Tech

griffin June 24, 2025, 11:31pm 3

It should be an IP SAN type. This would be IP.# in OpenSSL, not DNS.#.

A related post:

Topic		Replies	Views
Questions regarding "Announcing Six Day and IP Address Certificate Options in 2025" Help	48	2284	February 10, 2025
When will Let's Encrypt's IP certificates be officially launched? Feature Requests	99	6901	December 24, 2025
Subject Alternative Name (SAN) : field type ipAddress (IP in a CSR) Issuance Policy	23	25065	August 3, 2017
Certificate for public IP without domain name Issuance Tech	84	248722	September 20, 2018
IP Address certs and anycast Issuance Tech	16	838	October 16, 2025

Getting ready to issue IP address certificates

Related topics