3 ms·
GP may have been talking about "wildcard IP certificates" Or, even if they weren't, now I'm curious about that possibility too.
by DaSHacka 1y ago
GP may have been talking about "wildcard IP certificates"
Or, even if they weren't, now I'm curious about that possibility too.
- bc569a80a344f9c 1y agoDoesn't seem like that's possible. RFC5280 (https://datatracker.ietf.org/doc/html/rfc5280 https://datatracker.ietf.org/doc/html/rfc5280) defines these fields. Section 4.2.1.6 defines SANs, and specifies: > When the subjectAltName extension contains an iPAddress, the address MUST be stored in the octet string in "network byte order", as specified in [RFC791]. The least significant bit (LSB) of each octet is the LSB of the corresponding byte in the network address. For IP version 4, as specified in [RFC791], the octet string MUST contain exactly four octets. For IP version 6, as specified in [RFC2460], the octet string MUST contain exactly sixteen octets. That's 32 bits for IPv4 and 128 bits for IPv6. You can't store anything other than a single unicast IP address of either format with that much space.