Merge branch 'calm-dove'

Author: bashgeek

README.md

@@ -37,6 +37,10 @@ CoyoteCert introduces `dns-persist-01`: deploy the TXT record once, leave it in
 
 Let's Encrypt's `shortlived` profile issues 6-day certificates with no OCSP or CRL requirements. CoyoteCert passes the profile through and silently ignores it for CAs that don't support profiles yet.
 
+### IP address certificates (RFC 8738)
+
+Pass an IP address to `->identifiers()` and CoyoteCert handles the rest: `type: ip` on the ACME order, `IP:` SAN entries in the CSR. Mix hostnames and IPs freely in the same call. Useful for internal services, load balancer VIPs, and edge nodes where a hostname isn't always available.
+
 ### Swappable HTTP client (PSR-18)
 
 The built-in curl client needs no extra dependencies. Need proxy support, custom middleware, or framework integration? Swap it for any PSR-18 client (Symfony HttpClient, Guzzle, anything else) with one builder call.
@@ -92,7 +96,7 @@ use CoyoteCert\Storage\FilesystemStorage;
 
 $cert = CoyoteCert::with(new LetsEncrypt())
     ->storage(new FilesystemStorage('/var/certs'))
-    ->domains('example.com')
+    ->identifiers('example.com')
     ->email('admin@example.com')
     ->challenge(new Http01Handler('/var/www/html'))
     ->issueOrRenew();
@@ -443,7 +447,7 @@ Always requests a new certificate from the CA, regardless of what is in storage.
 ```php
 $cert = CoyoteCert::with(new LetsEncrypt())
     ->storage(new FilesystemStorage('/var/certs'))
-    ->domains('example.com')
+    ->identifiers('example.com')
     ->email('admin@example.com')
     ->challenge(new Http01Handler('/var/www/html'))
     ->issue();
@@ -456,7 +460,7 @@ The recommended method for production. Returns the existing certificate if it is
 ```php
 $cert = CoyoteCert::with(new LetsEncrypt())
     ->storage(new FilesystemStorage('/var/certs'))
-    ->domains('example.com')
+    ->identifiers('example.com')
     ->email('admin@example.com')
     ->challenge(new Http01Handler('/var/www/html'))
     ->issueOrRenew(daysBeforeExpiry: 30);
@@ -479,7 +483,7 @@ Check whether a renewal is needed without triggering one.
 ```php
 $coyote = CoyoteCert::with(new LetsEncrypt())
     ->storage(new FilesystemStorage('/var/certs'))
-    ->domains('example.com');
+    ->identifiers('example.com');
 
 if ($coyote->needsRenewal(30)) {
     // issue or alert
@@ -496,25 +500,50 @@ Returns `true` when:
 
 ## Wildcard and multi-domain certificates
 
-Pass an array of domains to `->domains()`. Wildcards require DNS-01 or dns-persist-01.
+Pass an array of domains to `->identifiers()`. Wildcards require DNS-01 or dns-persist-01.
 
 ```php
 // Multi-domain (SAN) certificate via HTTP-01
 CoyoteCert::with(new LetsEncrypt())
-    ->domains(['example.com', 'www.example.com', 'api.example.com'])
+    ->identifiers(['example.com', 'www.example.com', 'api.example.com'])
     ->challenge(new Http01Handler('/var/www/html'))
     ->issueOrRenew();
 
 // Wildcard certificate via DNS-01
 CoyoteCert::with(new LetsEncrypt())
-    ->domains(['example.com', '*.example.com'])
+    ->identifiers(['example.com', '*.example.com'])
     ->challenge(new CloudflareDns01Handler())
     ->issueOrRenew();
 ```
 
 `*.example.com` covers one label deep (`sub.example.com`) but not the apex (`example.com`). Include both if you need both.
 
-`->domains()` validates every entry against RFC-compliant hostname syntax and throws an `InvalidArgumentException` immediately for malformed input, so misconfigured domain lists are caught before any CA communication starts.
+`->identifiers()` validates every entry against RFC-compliant hostname syntax (or as an IP address) and throws an `AcmeException` immediately for malformed input, so misconfigured lists are caught before any CA communication starts.
+
+---
+
+## IP address certificates (RFC 8738)
+
+`->identifiers()` accepts IPv4 and IPv6 addresses alongside hostnames. CoyoteCert automatically sets `type: ip` on ACME identifiers and `IP:` SAN entries in the CSR — no extra API calls required.
+
+```php
+// IPv4-only certificate (e.g. with Let's Encrypt shortlived profile)
+CoyoteCert::with(new LetsEncrypt())
+    ->identifiers('192.0.2.1')
+    ->profile('shortlived')
+    ->challenge(new Http01Handler('/var/www/html'))
+    ->issueOrRenew();
+
+// Mixed hostname + IP certificate
+CoyoteCert::with(new LetsEncrypt())
+    ->identifiers(['example.com', '192.0.2.1', '2001:db8::1'])
+    ->challenge(new Http01Handler('/var/www/html'))
+    ->issueOrRenew();
+```
+
+IP SANs are validated via HTTP-01 (the CA connects to the IP directly). Wildcards cannot be combined with IP identifiers.
+
+Not all CAs support IP SANs — check your CA's documentation. Let's Encrypt supports them on both the `classic` and `shortlived` profiles.
 
 ---
 
@@ -540,7 +569,7 @@ $logger->pushHandler(new StreamHandler('/var/log/certs.log'));
 $cert = CoyoteCert::with(new LetsEncrypt())
     ->storage(new FilesystemStorage('/var/certs'))
     ->email('ops@example.com')
-    ->domains(['example.com', 'www.example.com'])
+    ->identifiers(['example.com', 'www.example.com'])
     ->challenge(new Http01Handler('/var/www/html'))
     ->logger($logger)
     ->issueOrRenew(daysBeforeExpiry: 30);
@@ -766,7 +795,7 @@ CoyoteCert::with(AcmeProviderInterface $provider)  // factory — select the CA
 | Method | Type | Default | Description |
 |---|---|---|---|
 | `->email(string)` | fluent | `''` | Contact email; required for ZeroSSL auto-provisioning |
-| `->domains(string\|array)` | fluent | — | Domain(s) to certify; first entry is the primary |
+| `->identifiers(string\|array)` | fluent | — | Domain(s) to certify; first entry is the primary |
 | `->challenge(ChallengeHandlerInterface)` | fluent | — | Challenge handler |
 | `->storage(StorageInterface)` | fluent | none | Storage backend |
 | `->keyType(KeyType)` | fluent | `EC_P256` | Certificate key algorithm |

src/CoyoteCert.php

@@ -29,15 +29,15 @@
  *
  *   $cert = CoyoteCert::with(new LetsEncrypt())
  *       ->storage(new FilesystemStorage('/var/certs'))
- *       ->domains(['example.com', 'www.example.com'])
+ *       ->identifiers(['example.com', 'www.example.com'])
  *       ->challenge(new Http01Handler('/var/www/html'))
  *       ->issue();
  *
  * Or to issue only when the certificate is close to expiry:
  *
  *   $cert = CoyoteCert::with(new LetsEncrypt())
  *       ->storage(new FilesystemStorage('/var/certs'))
- *       ->domains('example.com')
+ *       ->identifiers('example.com')
  *       ->challenge(new Http01Handler('/var/www/html'))
  *       ->issueOrRenew();
  */
@@ -112,14 +112,14 @@ public function httpClient(
         return $this;
     }
 
-    /** @param string|string[] $domains */
-    public function domains(array|string $domains): self
+    /** @param string|string[] $identifiers Domain names and/or IP addresses (RFC 8738). */
+    public function identifiers(array|string $identifiers): self
     {
-        $list = is_array($domains) ? array_values($domains) : [$domains];
+        $list = is_array($identifiers) ? array_values($identifiers) : [$identifiers];
 
         foreach ($list as $domain) {
-            if (!self::isValidDomain($domain)) {
-                throw new AcmeException(sprintf('Invalid domain name: "%s".', $domain));
+            if (!self::isValidDomain($domain) && !filter_var($domain, FILTER_VALIDATE_IP)) {
+                throw new AcmeException(sprintf('Invalid domain name or IP address: "%s".', $domain));
             }
         }
 
@@ -434,7 +434,7 @@ private function validate(): void
     {
         if (empty($this->domains)) {
             throw new AcmeException(
-                'No domains configured. Call ->domains() before issuing a certificate.',
+                'No identifiers configured. Call ->identifiers() before issuing a certificate.',
             );
         }
 

src/Endpoints/Order.php

@@ -22,12 +22,14 @@ public function new(AccountData $accountData, array $domains, string $profile =
     {
         $identifiers = [];
         foreach ($domains as $domain) {
-            if (preg_match_all('~(\*\.)~', $domain) > 1) {
+            $isIp = (bool) filter_var($domain, FILTER_VALIDATE_IP);
+
+            if (!$isIp && preg_match_all('~(\*\.)~', $domain) > 1) {
                 throw new AcmeException('Cannot create orders with multiple wildcards in one domain.');
             }
 
             $identifiers[] = [
-                'type'  => 'dns',
+                'type'  => $isIp ? 'ip' : 'dns',
                 'value' => $domain,
             ];
         }

src/Support/OpenSsl.php

@@ -51,8 +51,10 @@ public static function generateCsr(array $domains, OpenSSLAsymmetricKey $private
     {
         $dn = ['commonName' => $domains[0]];
 
-        $san = implode(',', array_map(function (string $dns): string {
-            return 'DNS:' . $dns;
+        $san = implode(',', array_map(function (string $identifier): string {
+            return filter_var($identifier, FILTER_VALIDATE_IP)
+                ? 'IP:' . $identifier
+                : 'DNS:' . $identifier;
         }, $domains));
 
         $tempFile = tmpfile();

tests/Integration/CoyoteCertIssueTest.php

@@ -9,7 +9,7 @@
 it('issues a certificate with default key types (RSA account, EC_P256 cert)', function () {
     $cert = CoyoteCert::with(pebble())
         ->storage(new InMemoryStorage())
-        ->domains('test.example.com')
+        ->identifiers('test.example.com')
         ->challenge(new NoOpHttp01Handler())
         ->skipLocalTest()
         ->issue();
@@ -25,7 +25,7 @@
 it('issues a certificate with an EC P-256 account key', function () {
     $cert = CoyoteCert::with(pebble())
         ->storage(new InMemoryStorage())
-        ->domains('ec-account.example.com')
+        ->identifiers('ec-account.example.com')
         ->accountKeyType(KeyType::EC_P256)
         ->challenge(new NoOpHttp01Handler())
         ->skipLocalTest()
@@ -39,15 +39,15 @@
 
     $first = CoyoteCert::with(pebble())
         ->storage($storage)
-        ->domains('reuse.example.com')
+        ->identifiers('reuse.example.com')
         ->challenge(new NoOpHttp01Handler())
         ->skipLocalTest()
         ->issue();
 
     // Second call reuses the account key already in $storage
     $second = CoyoteCert::with(pebble())
         ->storage($storage)
-        ->domains('reuse.example.com')
+        ->identifiers('reuse.example.com')
         ->challenge(new NoOpHttp01Handler())
         ->skipLocalTest()
         ->issue();
@@ -61,14 +61,14 @@
 
     $issued = CoyoteCert::with(pebble())
         ->storage($storage)
-        ->domains('cached.example.com')
+        ->identifiers('cached.example.com')
         ->challenge(new NoOpHttp01Handler())
         ->skipLocalTest()
         ->issue();
 
     $returned = CoyoteCert::with(pebble())
         ->storage($storage)
-        ->domains('cached.example.com')
+        ->identifiers('cached.example.com')
         ->challenge(new NoOpHttp01Handler())
         ->skipLocalTest()
         ->issueOrRenew(daysBeforeExpiry: 1);
@@ -79,7 +79,7 @@
 it('issues a certificate with the shortlived profile', function () {
     $cert = CoyoteCert::with(pebble())
         ->storage(new InMemoryStorage())
-        ->domains('profile.example.com')
+        ->identifiers('profile.example.com')
         ->profile('shortlived')
         ->challenge(new NoOpHttp01Handler())
         ->skipLocalTest()

tests/Integration/CoyoteCertRevokeTest.php

@@ -10,7 +10,7 @@
 
     $cert = CoyoteCert::with(pebble())
         ->storage($storage)
-        ->domains('revoke.example.com')
+        ->identifiers('revoke.example.com')
         ->challenge(new NoOpHttp01Handler())
         ->skipLocalTest()
         ->issue();
@@ -27,7 +27,7 @@
 
     $cert = CoyoteCert::with(pebble())
         ->storage($storage)
-        ->domains('revoke-reason.example.com')
+        ->identifiers('revoke-reason.example.com')
         ->challenge(new NoOpHttp01Handler())
         ->skipLocalTest()
         ->issue();
@@ -44,7 +44,7 @@
 
     $cert = CoyoteCert::with(pebble())
         ->storage($storage)
-        ->domains('revoke-nostorage.example.com')
+        ->identifiers('revoke-nostorage.example.com')
         ->challenge(new NoOpHttp01Handler())
         ->skipLocalTest()
         ->issue();