Does anyone know when Caddy plans on supporting this?
6-Day and IP Address Certificates Are Generally Available
11–20 of 290 posts
Re: 6-Day and IP Address Certificates Are Generally Available
#12As already noted on this thread, you can't use certbot today to get an IP address certificate. You can use lego [1], but figuring out the exact command line took me some effort yesterday. Here's what worked for me: lego --domains 206.189.27.68 --accept-tos --http --disable-cn run --profile shortlived [1] https://go-acme.github.io/lego/
I wonder if the support made it to Caddy yet (seems to be WIP https://github.com/caddyserver/caddy/issues/7399 )
IPv4 certs are already working fine for me in Caddy, but I think there's some kinks to work out with IPv6.
Re: 6-Day and IP Address Certificates Are Generally Available
#13If I can use my DHCP assigned IP, will this allow me to drop having to use self-signed certificates for localhost development?
Re: 6-Day and IP Address Certificates Are Generally Available
#14Earlier quoted context omitted.
No dependency on a registrar sounds nice. More anonymous.
IP addresses also are assigned by registrars (ARIN in the US and Canada, for instance).
Arguably neither is particularly secure, but you must have an IP so only needing to trust one of them seems better.
Re: 6-Day and IP Address Certificates Are Generally Available
#15This is interesting, I am guessing the use case for ip address certs is so your ephemeral services can do TLS communication, but now you don't need to depend on provisioning a record on the name server as well for something that you might be start hundreds or thousands of, that will only last for like an hour or day.
Maybe you want TLS but getting a proper subdomain for your project requires talking to a bunch of people who move slowly?
Re: 6-Day and IP Address Certificates Are Generally Available
#16If I can use my DHCP assigned IP, will this allow me to drop having to use self-signed certificates for localhost development?
No, they will only give out certificates if you can prove ownership of the IP, which means it being publicly routable.
Re: 6-Day and IP Address Certificates Are Generally Available
#17Something about a 6 day long IP address based token brings me back to the question of why we are wasting so much time on utterly wrong TOFU authorization?
If you are supposed to have an establishable identity I think there is DNSSEC back to the registrar for a name and (I'm not quite sure what?) back to the AS.for the IP.
Re: 6-Day and IP Address Certificates Are Generally Available
#18This is interesting, I am guessing the use case for ip address certs is so your ephemeral services can do TLS communication, but now you don't need to depend on provisioning a record on the name server as well for something that you might be start hundreds or thousands of, that will only last for like an hour or day.
Maybe you want TLS but getting a proper subdomain for your project requires talking to a bunch of people who move slowly?
Very very true, never thought about orgs like that. However, I don't think someone should use this like a bandaid like that. If the idea is that you want to have a domain associated with a service, then organizationally you probably need to have systems in place to make that easier.
Re: 6-Day and IP Address Certificates Are Generally Available
#19This is interesting, I am guessing the use case for ip address certs is so your ephemeral services can do TLS communication, but now you don't need to depend on provisioning a record on the name server as well for something that you might be start hundreds or thousands of, that will only last for like an hour or day.
> I am guessing the use case for ip address certs is so your ephemeral services can do TLS communication
There's also this little thing called DNS over TLS and DNS over HTTPS that you might have heard of ? ;)
Re: 6-Day and IP Address Certificates Are Generally Available
#20Something about a 6 day long IP address based token brings me back to the question of why we are wasting so much time on utterly wrong TOFU authorization? If you are supposed to have an establishable identity I think there is DNSSEC back to the registrar for a name and (I'm not quite sure what?) back to the AS.for the IP.
Domains map one-to-one with registrars, but multiple AS can be using the same IP address.