6-Day and IP Address Certificates Are Generally Available
letsencrypt.org
6-Day and IP Address Certificates Are Generally Available
1–10 of 290 posts
Re: 6-Day and IP Address Certificates Are Generally Available
#2For people who want IP certificates, keep in mind that certbot doesn't support it yet, with a PR still open to implement it: https://github.com/certbot/certbot/pull/10495
I think acme.sh supports it though.
Re: 6-Day and IP Address Certificates Are Generally Available
#3As already noted on this thread, you can't use certbot today to get an IP address certificate. You can use lego [1], but figuring out the exact command line took me some effort yesterday. Here's what worked for me:
lego --domains 206.189.27.68 --accept-tos --http --disable-cn run --profile shortlived
Re: 6-Day and IP Address Certificates Are Generally Available
#4This is interesting, I am guessing the use case for ip address certs is so your ephemeral services can do TLS communication, but now you don't need to depend on provisioning a record on the name server as well for something that you might be start hundreds or thousands of, that will only last for like an hour or day.
Re: 6-Day and IP Address Certificates Are Generally Available
#5This is interesting, I am guessing the use case for ip address certs is so your ephemeral services can do TLS communication, but now you don't need to depend on provisioning a record on the name server as well for something that you might be start hundreds or thousands of, that will only last for like an hour or day.
Yeah actually seems pretty useful to not rely on the name server for something that isn't human facing.
Re: 6-Day and IP Address Certificates Are Generally Available
#6This is interesting, I am guessing the use case for ip address certs is so your ephemeral services can do TLS communication, but now you don't need to depend on provisioning a record on the name server as well for something that you might be start hundreds or thousands of, that will only last for like an hour or day.
No dependency on a registrar sounds nice. More anonymous.
Re: 6-Day and IP Address Certificates Are Generally Available
#7This is interesting, I am guessing the use case for ip address certs is so your ephemeral services can do TLS communication, but now you don't need to depend on provisioning a record on the name server as well for something that you might be start hundreds or thousands of, that will only last for like an hour or day.
No dependency on a registrar sounds nice. More anonymous.
IP addresses also are assigned by registrars (ARIN in the US and Canada, for instance).
Re: 6-Day and IP Address Certificates Are Generally Available
#8For people who want IP certificates, keep in mind that certbot doesn't support it yet, with a PR still open to implement it: https://github.com/certbot/certbot/pull/10495 I think acme.sh supports it though.
Some ACME clients that I think currently support IP addresses are acme.sh, lego, traefik, acmez, caddy, and cert-manager. Certbot support should hopefully land pretty soon.
Re: 6-Day and IP Address Certificates Are Generally Available
#9Does anyone know when Caddy plans on supporting this?
Re: 6-Day and IP Address Certificates Are Generally Available
#10As already noted on this thread, you can't use certbot today to get an IP address certificate. You can use lego [1], but figuring out the exact command line took me some effort yesterday. Here's what worked for me: lego --domains 206.189.27.68 --accept-tos --http --disable-cn run --profile shortlived [1] https://go-acme.github.io/lego/
I wonder if the support made it to Caddy yet
(seems to be WIP https://github.com/caddyserver/caddy/issues/7399)