Need help getting cert with IP address

At present, the production LE service isn't issuing IP address certificates except to a number of accounts that have early access (When will Let's Encrypt's IP certificates be officially launched? refers)

crt.sh doesn't track the LE staging service so if your certificate is from the staging service, it won't show up there - or be trusted by devices that are using normal trust stores.

IPv6 SANs can be requested in the same way as IPv4 ones and I have a couple of staging certs with both. I'm using lego to request those certs, which @MikeMcQ mentioned a couple of posts back. IPv6 addresses have more scope for excitement as they can be compressed in different ways and use upper and lower case, so unless the client knows how to convert what's in an existing certificate and in its arguments into a consistent format, it can start trying to add addresses that are already there. Lego gets this right, but I had this problem with another client. (I won't mention the name as I can't remember which one it was and it may be sorted by now, this was a few months back.)

1 Like