Add RFC 8738 IP address identifiers #97
Conversation
Previously we only set the pebble-challtestsrv to bind its challenge interfaces to the IPv6 loopback. We want both IPv4 and IPv6 so we can issue for both.
This comment was marked as resolved.
This comment was marked as resolved.
| /// This is only relevant for DNS identifiers and must be false for other | ||
| /// types of identifiers (e.g. IP addresses). |
There was a problem hiding this comment.
This comes from a combination of RFC 8555 7.1.4 where it says (emphasis mine):
This field MUST be present and true for authorizations created as a result of a newOrder request containing a DNS identifier with a value that was a wildcard domain name. For other authorizations, it MUST be absent.
and a verified errata that further clarified it could be absent, or explicitly set false.
Typically the server decides what types of challenge are available for a given authorization, right? So I don't think there's anything for us to do here... |
Oh yeah, you're totally right 💡 Ok! |
This commit implements support for RFC 8738, the Automated Certificate Management Environment (ACME) IP Identifier Validation Extension.
Adds an IPv4 and IPv6 address to the HTTP-01 issuance test.
2 participants
While Let's Encrypt has announced upcoming support for issuing certificates for IP address subjects, it isn't available yet.
Fortunately, Pebble does support this, so we can implement the feature now and have it ready for Let's Encrypt's staging and production environments.
See RFC 8738.