[PR #1073] [CLOSED] fix: disable CN in CSR for tlsserver and shortlived profiles #1130

New issue

Closed

opened 2026-03-03 01:07:49 +03:00 by kerem · 0 comments

kerem commented

2026-03-03 01:07:49 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/certimate-go/certimate/pull/1073
Author: @ZeroClover
Created: 12/1/2025
Status: ❌ Closed

Base: main ← Head: fix/disable-cn-for-ip-certs

📝 Commits (1)

91677b2 fix: disable CN in CSR for tlsserver and shortlived profiles

📊 Changes

2 files changed (+8 additions, -0 deletions)

View changed files

📝 cmd/intercmd.go (+4 -0)
📝 internal/workflow/engine/executor_bizapply.go (+4 -0)

📄 Description

Problem

Let's Encrypt rejects Certificate Signing Requests (CSR) that contain IP addresses in the Common Name (CN) field with the error:

CSR contains IP address in Common Name

While Let's Encrypt supports issuing certificates for IP addresses (with the IP in the SAN extension), the CN field cannot contain IP addresses according to their policy.

Root Cause

Although lego v4.28.1 includes the fix from go-acme/lego#2570 that added the DisableCommonName option, this option must be explicitly set by the application. Certimate was not setting this option, causing IP addresses to be placed in the CN field.

Solution

This PR automatically sets DisableCommonName = true when using the tlsserver or shortlived ACME profiles:

These profiles create certificates without CN by design
IP address certificates require the shortlived profile
This approach aligns with the profiles' intended behavior

Changes

Modified two locations where the lego client is initialized:

internal/workflow/engine/executor_bizapply.go (main workflow executor)
cmd/intercmd.go (multi-process certificate application command)

Testing

Code compiles successfully
Code style matches project conventions
Tested with IP address certificate requests (requires Let's Encrypt account with shortlived profile access)

References

Lego PR: https://github.com/go-acme/lego/pull/2570
Lego Issue: https://github.com/go-acme/lego/issues/2567

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/certimate-go/certimate/pull/1073 **Author:** [@ZeroClover](https://github.com/ZeroClover) **Created:** 12/1/2025 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/disable-cn-for-ip-certs` --- ### 📝 Commits (1) - [`91677b2`](https://github.com/certimate-go/certimate/commit/91677b29c4b11c2b3c0007253a14a8660e055979) fix: disable CN in CSR for tlsserver and shortlived profiles ### 📊 Changes **2 files changed** (+8 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `cmd/intercmd.go` (+4 -0) 📝 `internal/workflow/engine/executor_bizapply.go` (+4 -0) </details> ### 📄 Description ## Problem Let's Encrypt rejects Certificate Signing Requests (CSR) that contain IP addresses in the Common Name (CN) field with the error: > CSR contains IP address in Common Name While Let's Encrypt supports issuing certificates for IP addresses (with the IP in the SAN extension), the CN field cannot contain IP addresses according to their policy. ## Root Cause Although lego v4.28.1 includes the fix from go-acme/lego#2570 that added the `DisableCommonName` option, this option must be explicitly set by the application. Certimate was not setting this option, causing IP addresses to be placed in the CN field. ## Solution This PR automatically sets `DisableCommonName = true` when using the `tlsserver` or `shortlived` ACME profiles: - These profiles create certificates without CN by design - IP address certificates require the `shortlived` profile - This approach aligns with the profiles' intended behavior ## Changes Modified two locations where the lego client is initialized: - `internal/workflow/engine/executor_bizapply.go` (main workflow executor) - `cmd/intercmd.go` (multi-process certificate application command) ## Testing - [x] Code compiles successfully - [x] Code style matches project conventions - [ ] Tested with IP address certificate requests (requires Let's Encrypt account with shortlived profile access) ## References - Lego PR: https://github.com/go-acme/lego/pull/2570 - Lego Issue: https://github.com/go-acme/lego/issues/2567 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>