Fix HTTP-01 challenge for IPv6 literal addresses

[nekohasekai]

What changed

Strip square brackets from bare IPv6 literals in hostOnly() when net.SplitHostPort returns an error.

Why

For HTTP-01 validation against an IPv6 literal, the CA sends a Host header like [2001:db8::1] without a port.

hostOnly() returns that bracketed value, while challenge.Identifier.Value holds the bare IPv6 address, so the host check fails.

Validation

• go test ./...

[mholt]

Huh... is that even valid form? I thought [] only should be used when there's a port. And there's no ports in ACME challenge identifier values. Where are you seeing this?

[nekohasekai]

Yes, it's valid form — see RFC 9112 §3.2: Host = uri-host [ ":" port ], and uri-host is defined in RFC 3986 §3.2.2 where IP-literal = "[" IPv6address "]". The brackets are part of the IP-literal grammar, not the port separator, so the port is independently optional.

It's exactly what Boulder produces. va/http.go wraps IPv6 identifiers in brackets and then constructs url.URL{Scheme: "http", Host: host, Path: path} without a port (httpPort is only handed to the dialer). When Go's net/http serializes that to the wire, the Host header is literally [2001:db8::1] — no port.

Reproducer:

req, _ := http.NewRequest("GET", "http://[2001:db8::1]/.well-known/acme-challenge/x", nil)
// req.Host == "[2001:db8::1]"
// wire: "Host: [2001:db8::1]"

Downstream this hits hostOnly() in certificates.go:651. net.SplitHostPort("[2001:db8::1]") returns missing port in address, so it falls through to return the bracketed input, and strings.EqualFold("[2001:db8::1]", "2001:db8::1") fails the DNS-rebinding check in solveHTTPChallenge.

[mholt]

Ok. Fair enough I guess, thank you