From: "Anthony J. Bentley" <bentley@openbsd.org>
Subject: Re: [stu@spacehopper.org: Re: acme-client(1): add support for let's encrypt iPAddress certificates]
To: tech@openbsd.org
Date: Sun, 22 Feb 2026 07:27:31 -0700

Florian Obser writes:
> This is on top of the CN removal diff.
>
> I tweaked a bunch of things:
>
> + keyproc.c & json.c: KNF;  made "first" less awkward
> + revokeproc.c: asprintf & inet_ntop can fail, add vis, prevent asprintf
>   leak
> + main.c: calloc error check
> + parse.y: getaddrinfo(3) with AI_NUMERICHOST is the canonical way to
>   figure out if a thing is an ip address; fixed duplicate "DOMAIN
>   PROFILE" (bad merge)
>
> With the parse.y change we no longer need to prefix IP addresses with
> IP:, which I found to be a nuisance.

I've tested this diff, all my current certificates renew normally and I
can successfully acquire IPv4 and IPv6 certificates.