4 ms·

Interesting that https://1.1.1.1/ https://1.1.1.1/ has a valid SSL Cert when you can't issue public valid certs for IPs

patrickmcmanus 9y ago
ip addresses in certificates are unusual, but allowed. https://cabforum.org/guidance-ip-addresses-certificates/ https://cabforum.org/guidance-ip-addresses-certificates/
pfg 9y ago
Publicly-trusted CAs can issue trusted certificates for IP addresses. It's simply far less commonly used, and most CAs either don't offer it at all or only for enterprise clients. (You might have been thinking about issuance for IP addresses in private/reserved IP space. That is indeed prohibited nowadays, just like "internal names", i.e. domains that don't end in a public suffix.)
stordoff 9y ago
It's dependant on CA support, rather than being impossible per se. E.g. GlobalSign: https://support.globalsign.com/customer/portal/articles/1216536-securing-a-public-ip-address---ssl-certificates https://support.globalsign.com/customer/portal/articles/1216...
edsouza 9y ago
The certificate "Common Name" is: dns.cloudflare.com. There is a certificate extension - Certificate Subject Alternative Name that lists the following: DNS Name: *.dns.cloudflare.com DNS Name: dns.cloudflare.com IP Address: 1.1.1.1 IP Address: 1.0.0.1 Most likely the extension was included as part of the certificate signing request.
- prdonahue 9y ago
  Most CAs ignore the subjectAltName extension when parsing CSRs (as it's a pain[1] for users to generate one properly). They just extract the public key, CN, and let you fill in SANs. 1 - Before Cloudflare I used to do this with OpenSSL and it requires half a dozen steps, but with cfssl you can do this quite easily: https://github.com/cloudflare/cfssl/wiki/Creating-a-new-CSR https://github.com/cloudflare/cfssl/wiki/Creating-a-new-CSR.
  - silverwind 9y ago
    You can generate SAN CSRs with a openssl one-liner, not that hard.
    - prdonahue 9y ago
      With a default install/config? Do tell.
prdonahue 9y ago
As the person who placed the order, yes you definitely can :) Starting November 1, 2015 [1], you could no longer obtain certificates for "Reserved IP Addresses" [2] and any still in existence on October 1, 2016 had to be revoked. Section 3.2.2.5 of the BRs indicate how one can demonstrate control over the IP address. -- 1 - https://github.com/cabforum/documents/blob/master/docs/BR.md#122relevant-dates https://github.com/cabforum/documents/blob/master/docs/BR.md... 2 - https://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml; https://www.iana.org/assignments/ipv4-address-space/ipv4-add... http://www.iana.org/assignments/ipv6-address-space/ipv6-address-space.xml http://www.iana.org/assignments/ipv6-address-space/ipv6-addr... 3 - https://github.com/cabforum/documents/blob/master/docs/BR.md#3225-authentication-for-an-ip-address https://github.com/cabforum/documents/blob/master/docs/BR.md...

ip addresses in certificates are unusual, but allowed. https://cabforum.org/guidance-ip-addresses-certificates/ https://cabforum.org/guidance-ip-addresses-certificates/

pfg 9y ago

Publicly-trusted CAs can issue trusted certificates for IP addresses. It's simply far less commonly used, and most CAs either don't offer it at all or only for enterprise clients. (You might have been thinking about issuance for IP addresses in private/reserved IP space. That is indeed prohibited nowadays, just like "internal names", i.e. domains that don't end in a public suffix.)

stordoff 9y ago

It's dependant on CA support, rather than being impossible per se. E.g. GlobalSign: https://support.globalsign.com/customer/portal/articles/1216536-securing-a-public-ip-address---ssl-certificates https://support.globalsign.com/customer/portal/articles/1216...

edsouza 9y ago

The certificate "Common Name" is: dns.cloudflare.com. There is a certificate extension - Certificate Subject Alternative Name that lists the following: DNS Name: *.dns.cloudflare.com DNS Name: dns.cloudflare.com IP Address: 1.1.1.1 IP Address: 1.0.0.1 Most likely the extension was included as part of the certificate signing request.

prdonahue 9y ago
Most CAs ignore the subjectAltName extension when parsing CSRs (as it's a pain[1] for users to generate one properly). They just extract the public key, CN, and let you fill in SANs. 1 - Before Cloudflare I used to do this with OpenSSL and it requires half a dozen steps, but with cfssl you can do this quite easily: https://github.com/cloudflare/cfssl/wiki/Creating-a-new-CSR https://github.com/cloudflare/cfssl/wiki/Creating-a-new-CSR.
- silverwind 9y ago
  You can generate SAN CSRs with a openssl one-liner, not that hard.
  - prdonahue 9y ago
    With a default install/config? Do tell.

prdonahue 9y ago

As the person who placed the order, yes you definitely can :) Starting November 1, 2015 [1], you could no longer obtain certificates for "Reserved IP Addresses" [2] and any still in existence on October 1, 2016 had to be revoked. Section 3.2.2.5 of the BRs indicate how one can demonstrate control over the IP address. -- 1 - https://github.com/cabforum/documents/blob/master/docs/BR.md#122relevant-dates https://github.com/cabforum/documents/blob/master/docs/BR.md... 2 - https://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml; https://www.iana.org/assignments/ipv4-address-space/ipv4-add... http://www.iana.org/assignments/ipv6-address-space/ipv6-address-space.xml http://www.iana.org/assignments/ipv6-address-space/ipv6-addr... 3 - https://github.com/cabforum/documents/blob/master/docs/BR.md#3225-authentication-for-an-ip-address https://github.com/cabforum/documents/blob/master/docs/BR.md...