2 ms·
> (often with direct ip instead of domain name, so no https there anyway). That's not true, one can have IP addresses in certificates, it's just very rare beca
by mdaniel 2y ago
> (often with direct ip instead of domain name, so no https there anyway).
That's not true, one can have IP addresses in certificates, it's just very rare because virtual hosting makes "single IP" services rare nowadays: https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6 https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6 ("Defined options include an Internet electronic mail address, a DNS name, an IP address, and a Uniform Resource Identifier (URI).") OpenSSL uses "IP:" syntax in their subjectAltName field (e.g. https://mta.openssl.org/pipermail/openssl-users/2016-September/004515.html https://mta.openssl.org/pipermail/openssl-users/2016-Septemb... ) and the CAB seems to be on-board, subject to some "well, watch out for ..." language https://cabforum.org/working-groups/server/guidance-ip-addresses-certificates/ https://cabforum.org/working-groups/server/guidance-ip-addre...
- _flux 2y agoSo do CAs in general offer those? Are they as affordable as "normal" certs? Certainly you need to be paying for that those kind of certificates, possibly some premium? It's probably not worth it anyway, because you're now stuck with that single IP, for little benefit. In general IPs just don't get HTTPS certificates acquired for them.
- mdaniel 2y agoSeems to be free from ZeroSSL https://help.zerossl.com/hc/en-us/articles/360060119973-Is-It-Possible-To-Generate-a-SSL-Certificate-for-an-IP-Address https://help.zerossl.com/hc/en-us/articles/360060119973-Is-I... but Letsencrypt decided against it since their whole thing is about proving ownership over a domain, or set of domains, and doing that for an IP address would be some nonsense. I would be absolutely shocked if the "name brand" cert issuers don't support CSRs containing iPAddress SAN entries, since it's very clearly part of the RFC, but I haven't ever had a need to try such a stunt, either
- wslwsl 2y agoyou can get a free cert from ZeroSSL for an IP address https://help.zerossl.com/hc/en-us/articles/360060119973-Is-It-Possible-To-Generate-a-SSL-Certificate-for-an-IP-Address https://help.zerossl.com/hc/en-us/articles/360060119973-Is-I...
- deleted 2y ago[deleted]