Bug #17000
openAllow IPv6 SAN entries
90%
Description
There are multiple problems using bare IPv6 addresses in SAN entries:
- The ACME SAN validation currently only checks for hostnames and wildcard hostnames. It allows IPv4 addresses as well, as those pass the hostname validation, but it does not allow IPv6 addresses.
- It does not appear to be listening properly for IPv6 validation using standalone modes (HTTP or TLS-ALPN)
JP Updated by Jim Pingle about 1 month ago
- Status changed from New to In Progress
The validation problem is an easy fix, but the second point is actually an upstream bug in acme.sh and how it uses socat:
https://github.com/acmesh-official/acme.sh/issues/7185
I intend to add the change I suggested there to our local fork, but if they opt for a different approach upstream that will need to be reverted and we may need additional changes in the code that calls acme.sh depending on the options they want.
JP Updated by Jim Pingle about 1 month ago
- Status changed from In Progress to Feedback
- % Done changed from 0 to 100
Fixed in ACME pkg v1.3.2
JP Updated by Jim Pingle about 1 month ago
- Status changed from Feedback to In Progress
- % Done changed from 100 to 90
The bug is fixed upstream now , and they way they fixed it, it listens on both by default but should also listen on both when passed both --listen-v4 and --listen-v6.
The way the package is passing options should still work OK once we back out the change on acme.sh and pick up the upstream change.
We could change the GUI options for standalone mode so it doesn't pass any listening options at all and allow it to bind to both all the time without needing to set an IPv6 option. The way networking is configured on pfSense that should always function and there are not likely any configurations where binding to both would negatively impact renewals.