freeipa

#7451 Allow issuing certificates with IP addresses in subjectAltName
Closed: fixed by ftweedal. Opened by ftweedal.

Closed: fixed
Reopen Issue

Request for enhancement

Allow issuing certificates with IP addresses in the subject
alternative name (SAN), if all of the following are true.

  • One of the DNS names in the SAN resolves to the IP address
    (possibly through a CNAME).
  • All of the DNS entries in the resolution chain are managed by
    this IPA instance.
  • The IP address has a (correct) reverse DNS entry that is managed
    by this IPA instance

The approach was discusesd and agreed on freeipa-devel mailing list:
https://lists.fedoraproject.org/archives/list/freeipa-devel@lists.fedorahosted.org/message/5MFHNX4K35AKBSV2KUGZKON5SQ6GWEMI/

Metadata Update from @ftweedal:
- Issue assigned to ipilcher

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1586268

Issue linked to Bugzilla: Bug 1586268

Work in progress Pull Request: https://github.com/freeipa/freeipa/pull/1843

Metadata Update from @abiagion:
- Issue set to the milestone: FreeIPA 4.8

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/1843

Moving the milestone to 4.6.5 so that the feature gets included in ipa-4-6 branch.

Metadata Update from @frenaud:
- Issue set to the milestone: FreeIPA 4.6.5 (was: FreeIPA 4.8)

master:

  • dccb2e0eb8953e449dadc344aaa7cd0d173b9717 Allow issuing certificates with IP addresses in subjectAltName
  • 8ec4868a64a193917ee2c424ba5fdbf17f14b4ad cert-request: restrict IPAddress SAN to host/service principals
  • eb70e64c0b0cd867dc0d771a3a145e5549012f92 cert-request: collect only qualified DNS names for IPAddress validation
  • 9c750f0738ccc81004ced8cd1c816e48be539f8b cert-request: generalise _san_dnsname_ips for arbitrary cname depth
  • e37c025dac7c89aa59de98d66a443d49f6009de5 cert-request: report all unmatched SAN IP addresses
  • 474a2e6952e15fe3bf1bbf16853ecdc157355b0b Add tests for cert-request IP address SAN support
  • a65c12d042e480ac5ff1c327feb94221c4b76782 cert-request: more specific errors in IP address validation

master:

  • 8327e11b6 cert-request: handle missing zone
Edited by ftweedal

ipa-4-7:

  • 142b0dde8df64790562c38cb5ef4171f24a07529 Allow issuing certificates with IP addresses in subjectAltName
  • f34f099f6ccf835d39e83062f732cf914565bac9 cert-request: restrict IPAddress SAN to host/service principals
  • 7107eb1c4fd3eb46f6f6082ee4bd493fc103853c cert-request: collect only qualified DNS names for IPAddress validation
  • 8dc25eb2483bb87cc309a9157aebbb7db6c823f5 cert-request: generalise _san_dnsname_ips for arbitrary cname depth
  • ba93f55b678b872df31fbe2ef81901e6698443ad cert-request: report all unmatched SAN IP addresses
  • b5324b5db925f93b7b14fcffead895d013e5278f Add tests for cert-request IP address SAN support
  • d0b915cb46e06513af2a1abba395d7255e3bcb6f cert-request: more specific errors in IP address validation
  • d07ca488c4af12bba56f04e70007205cd53b66f5 (HEAD) cert-request: handle missing zone

ipa-4-6:

  • 5aa8b7a50fdf979ffb2894c1da2c06536c433fee Allow issuing certificates with IP addresses in subjectAltName
  • dd93dd1aa7dfe2a75821bad264a1fbaae935415e cert-request: restrict IPAddress SAN to host/service principals
  • 42c69a05ee4bf431e5c9783b32a9ef49bd14037a cert-request: collect only qualified DNS names for IPAddress validation
  • ed3ef2042e5e048dc9b7f630bc4393a69f1e3dea cert-request: generalise _san_dnsname_ips for arbitrary cname depth
  • 6e5c2d996f148267ef74daadea71d4f5c2701312 cert-request: report all unmatched SAN IP addresses
  • 0295908c9ac6c2bbb95c133f2dc38def78645284 Add tests for cert-request IP address SAN support
  • 1a78844dbdc147b8b85ef3821d055fa2b696ef0c cert-request: more specific errors in IP address validation
  • 94ecaaa4b6651d387a642c3ef07b21f47408347d cert-request: handle missing zone
  • cbb972998b2ab7692764b49f578cc106920aa76e cert-request: fix py2 unicode/str issues
  • 0170fd8f1f70c87d77785027d1f9005e525e999b (HEAD) pylintrc: ignore R1720 no-else-raise errors

Metadata Update from @ftweedal:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/1843
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.