3 ms·

This is the first time I've seen a certificate issued to an IP address. Cloudflare does the same thing for 1.1.1.1. X509v3 Subject Alternative Name:

• tialaramex 5y ago
  You can use this for any purpose. These certificates conform to PKIX and are part of the Web PKI if they're issued (as this was) by a trusted CA. In some ways the actual rules for IP addresses are less strict than for DNS names. Perhaps this will get tightened up. Google Trust Services (the part of Google which issues certificates, as distinct from say, Chrome, which on behalf of Relying Parties has to decide if the certificates are trustworthy) expressed interest in issuing IP address certificates via ACME, ie automatically to anyone who asks. The pushback (including from people in other parts of Google) was considerable, even though what GTS proposed to do was actually more robust than what's technically required for issuance today. But it's nice that they asked (and indeed one argument to allow what they requested is, hey, there was no requirement for them to ask, if somebody had just done this without asking would we have been even more unhappy about that or would we let it slide?) In practical terms, you likely don't get and don't want certificates with ipAddress SANs in them. You probably don't get them because (unless GTS went ahead subsequently) this is a Special Request item not something your Certbot or acme.sh or whatever can get for you, and you probably don't want them because unless you're a DNS server people expect to type in a name, not a sequence of arcane numbers.
  • jcims 5y ago
    Awesome info, thank you!
• deleted 5y ago
  [deleted]