RFC 8738 IP Identifier Validation Support

Leo1003 commented 2 days ago

RFC 8738 add support for certificate having IP address in their SANs.

It would be nice to support that since people might have some servers using IP address in their private network (e.g. LDAP server, database server, mail server...).

uedvt359 commented 2 days ago

agreed, this would be nice! we don't have immediate plans for implementing this, but a PR would be gladly accepted.

at first glance, there should not be many changes necessary, but i haven't read the spec yet. what i'm remembering:

https://github.com/dvtirol/serles-acme/blob/master/serles/views.py#L124-L135: allow ip type and don't generate dns challenge for it
https://github.com/dvtirol/serles-acme/blob/master/serles/challenge.py#L328-L329: this optional extra check only makes sense for dns type identifiers and should be disabled.

if you can think of anything else, please let us know

Leo1003 commented 1 day ago

I currently have an initial implementation on my fork. However, I haven't well tested it yet and it requires some modifications to merge back to this repo. I think I can submit a PR after resolving these issues.

dvtirol / serles-acme

RFC 8738 IP Identifier Validation Support #11