Skip to content

Conversation

@schoen
Copy link
Collaborator

@schoen schoen commented Oct 23, 2025

This pull request proposes to add a new documentation page that talks about how combining IP address identifiers and domain names can create a privacy risk if the IP address identifiers are on a home network (e.g., with a NAS).

@bdaehlie bdaehlie requested a review from aarongable October 23, 2025 11:30
Copy link
Contributor

@aarongable aarongable left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While I think the content and ideas here are good, structurally this feels odd to me. If the point of the article (as suggested by the title) is privacy concerns, then those concerns should be front-and-center, not buried in third-level headings halfway through the article.

I would recommend a simpler structure with just three sections:

# Privacy Considerations for IP Address Certificates

Intro, saying that IP certs are new, and that they have some privacy considerations which are shared with domain name certs, and some that are new.

## Revealing the Existence of IPs

Describe certificate transparency; point out that DNS certs are already in CT. Point out that the IPv4 space is constantly being crawled, but the IPv6 space is too big. Conclude that getting a cert for an IPv6 addr will reveal the existence of a web service at that addresses, and may result in actors both good and bad attempting to crawl that service.

## Binding IPs to Domain Names

The content you have for this is pretty good already. But also add the bit about sharing public keys between IP and DNS certs, so that doesn't have to be buried in the next section.

## Recommendations

The current text doesn't have any recommendations for individuals -- just for device manufacturers and people with data centers. Start with recommendations for Joe Schmoe, who just read this article and is now a bit scared he's gonna mess up. Then move on to device manufacturers and large operators.


# Privacy Considerations for Home Use of IP Address Certificates

Since [July 2025](https://letsencrypt.org/2025/07/01/issuing-our-first-ip-address-certificate), Let’s Encrypt has been able to issue certificates for IP addresses, in addition to its traditional certificates covering domain names.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Avoid using "smart quotes", here and throughout.

Suggested change
Since [July 2025](https://letsencrypt.org/2025/07/01/issuing-our-first-ip-address-certificate), Lets Encrypt has been able to issue certificates for IP addresses, in addition to its traditional certificates covering domain names.
Since [July 2025](https://letsencrypt.org/2025/07/01/issuing-our-first-ip-address-certificate), Let's Encrypt has been able to issue certificates for IP addresses, in addition to its traditional certificates covering domain names.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants