/cc @FiloSottile

@sleevi Does Windows 7 have known issues with IP SANs?

We use the system certificate verifier on Windows, so we might not be able to do much about this.

@FiloSottile Indeed Windows does! The CA/B Forum even published a lovely paper about how to "do iPAddress SANs right", based in part on my rantings and unwillingness to compromise on violating 5280 ;)

Since it requires the server (in this case, Cloudflare) to change how they use they construct the certificate, unfortunately, this incompatibility with the Windows verifier can only be resolved by them changing how they construct certificates.

In case you reach someone at Cloudflare who can make the change, a 'compatible' certificate would thus be:

• 1.1.1.1 in the commonName
• 1.1.1.1 as an iPAddress SAN
• cloudflare-dns.com as a dNSName SAN
• *.cloudflare-dns.com as a dNSName SAN
• one.one.one.one as a dNSName SAN

They would create an equivalent certificate for each IP address they're serving.

For IPv6, Windows will do a direct string mapping to the CN, so that means it will be somewhat client-dependent as to how they entered the host in the above example. In general, using the compressed form (as that most reflects how users will enter in the address to connect) is likely the best approach.

This is unfortunate, but not worth overriding the system verifier for I'm afraid. (For example we would still end up not trusting IP address certificates signed by custom roots.)