Automated Certificate Management Environment (ACME) IP Identifier Validation Extension
Extracted elements (13)
Because RFC 6066 prohibits IP addresses in the TLS SNI HostName field, the reverse DNS mapping (IN-ADDR.ARPA / IP6.ARPA) is used as a workaround to allow the "tls-alpn-01" challenge to function with IP address identifiers without violating TLS extension constraints.
IP identifiers MAY be used with the existing "http-01" and "tls-alpn-01" challenges defined in RFC 8555 and RFC 8737 respectively, extending those challenge types to cover IP address validation without defining new challenge mechanisms.
An ACME server wishing to request proof that a user controls an IPv4 or IPv6 address MUST create an authorization with the identifier type "ip".
Because RFC 6066 does not permit IP addresses in the SNI HostName field, the server MUST use the IN-ADDR.ARPA or IP6.ARPA reverse mapping of the IP address as the SNI HostName field value for "tls-alpn-01" challenges.
For the "http-01" challenge with IP identifiers, the Host header field MUST be set to the IP address being validated per RFC 7230, using RFC 1123 format for IPv4 and RFC 5952 format for IPv6.
For the "tls-alpn-01" challenge, the subjectAltName extension in the validation certificate MUST contain a single iPAddress that matches the address being validated.
The existing "dns-01" challenge MUST NOT be used to validate IP identifiers.
The value field of an "ip" identifier MUST contain the textual form of the address as defined in RFC 1123 Section 2.1 for IPv4 and RFC 5952 Section 4 for IPv6.
When using "http-01" or "tls-alpn-01" challenges with IP identifiers, the initial DNS resolution step MUST be skipped and the IP address used for validation MUST be the value of the identifier.
The IP identifier type uses the type string "ip" with the value field containing the textual form of the IP address: RFC 1123 Section 2.1 format for IPv4 and RFC 5952 Section 4 format for IPv6. For example: {"type": "ip", "value": "2001:db8::1"}.
A new entry with Label "ip" and Reference "RFC 8738" has been added to the "ACME Identifier Types" registry defined in RFC 8555 Section 9.7.7.
Two new entries have been added to the "ACME Validation Methods" registry: "http-01" for identifier type "ip" and "tls-alpn-01" for identifier type "ip", both referencing RFC 8738.
The extensions to ACME described in this document do not deviate from the broader threat model described in RFC 8555 Section 10.1. CAs may wish to impose additional restrictions for IP addresses belonging to ISPs or cloud providers with short delegation periods.