Stuart Henderson wrote:
> > If this is an invalid config, it should be rejected by the parser.
>
> I think it's kind-of an invalid config, though not tricky to
> unambiguously do the right thing with so maybe we should do that.
> These would be similar:
>
> domain foo.example {
> alternative names { foo.example }
> ...
> }
>
> domain 1.2.3.4 {
> alternative names { foo.example }
> alternative names { foo.example }
> ...
> }
I took a fresh look at the acme-client parser code and the man page.
The man page states the 'domain name' directive is:
> to be used as the primary Subject Alternative Name (SAN)
with 'alternative names' as a "list of additional names".
This implies a configuration with 'alternative names' that lacks a
'domain name' directive (such as the examples below) is invalid.
My thought is the parser should be updated to reject such invalid
configs which is causing unpredictable output.
I.e. 'alternative names' requires a previous 'domain name' directive
at least the way the code currently behaves.
Separately, we should update the man page to reflect that both the
'domain' and 'domain name' directives can accept both a DNS name or
an IP address. Right now it's ambiguous and somewhat undocumented.
I gave that a go (and clarified the wording) in the patch below.
Regards
Lloyd
--- acme-client.conf.5.old Tue Oct 20 00:32:01 2026
+++ acme-client.conf.5 Tue Oct 20 01:03:00 2026
@@ -115,13 +115,16 @@ The certificates to be obtained through ACME.
Each domain section begins with the
.Ic domain
keyword followed by an identifier for this domain block.
-This is usually the domain name however, if requesting
-certificates of different types (EC and RSA) for the same name,
-the
+This is usually the fully-qualified domain name; however, if requesting
+certificates of different types (EC and RSA) for the same domain, the
.Ar handle
-identifiers should be unique and the
+identifiers should be unique, with an additional
.Cm domain name
-directive should be used.
+directive added to specify the primary Subject Alternative Name.
+.Pp
+Valid IPv4 and IPv6 addresses may also be used as the
+.Ar handle
+if they are supported by your CA and profile.
.El
.Pp
It is followed by a block of options enclosed in curly brackets:
@@ -134,7 +137,9 @@ in the X.509 certificate.
This is optional.
If not specified, the
.Ar handle
-of the domain block will be used.
+of the domain block will be used. The
+.Ar name
+may be a FQDN, IPv4, or IPv6 address as accepted by your CA.
.It Ic alternative names Brq ...
A list of additional names,
comma or space separated,
