Subject: [Dots] IPaddress in certificates

From: Robert Moskowitz <[email-masked]>
Date: Tue, 14 Nov 2017 15:17:44 +0800

I just checked and RFC 5280 does allow IPaddresses in subjectAltName, 
but as I recall from the debates...  Better DNSname.

A provider that is issuing certificates to a client that is only known 
by IPaddress should be smart and have some way to map that to a name so 
that certificates will still continue to work if the device is 
readdressed.  I can think of half-a-dozen ways to do this.

Just seem to recall all sorts of negative comments of addresses in certs.

Bob

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Tue, 14 Nov 2017 08:54:09 +0000

Agreed, https://tools.ietf.org/html/rfc6125 discusses various drawbacks of using IP addresses in subjectAltName. Even DNS-over-(D)TLS for server authentication uses "authentication domain names" for PKIX Certificate Based Authentication and not IP addresses.

-Tiru

> -----Original Message-----
> From: Dots [mailto:[email-masked]] On Behalf Of Robert Moskowitz
> Sent: Tuesday, November 14, 2017 12:48 PM
> To: [email-masked]
> Subject: [Dots] IPaddress in certificates
> 
> I just checked and RFC 5280 does allow IPaddresses in subjectAltName, but
> as I recall from the debates...  Better DNSname.
> 
> A provider that is issuing certificates to a client that is only known by
> IPaddress should be smart and have some way to map that to a name so that
> certificates will still continue to work if the device is readdressed.  I can think
> of half-a-dozen ways to do this.
> 
> _______________________________________________
> Dots mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dots