Certificate Provider: TLS ACME HTTP-01 challenge fails for IPv6 literal address

[skrik2]

Operating system

Linux

System version

debian 12

Installation type

Original sing-box Command Line

If you are using a graphical client, please provide the version of the client.

No response

Version

sing-box version 1.14.0-alpha.7-72633ba7

Environment: go1.25.6 linux/amd64
Tags: with_gvisor,with_quic,with_dhcp,with_wireguard,with_utls,with_acme,with_clash_api,with_tailscale,with_ccm,with_ocm,badlinkname,tfogo_checklinkname0
Revision: 72633ba794a0f2e1dd6db571b9441c16368463f6
CGO: enabled

Description

When using sing-box to obtain TLS certificates via ACME with the HTTP-01 challenge on a pure IPv6 literal address (no domain), the certificate issuance fails.

Reproduction

Use the minimal configuration below:

{
    "certificate_providers": [
        {
            "type": "acme",
            "tag": "test.acme.01",
            "domain": [
                "xxxx::xxxx:xxxx:xxxx:7464:b704:462e:0"
            ],
            "email": "email@example.com",
            "provider": "letsencrypt",
            "disable_http_challenge": false,
            "disable_tls_alpn_challenge": true
        }
    ]
}

Logs

Supporter

• I am a sponsor

Integrity requirements

• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I confirm that I have provided the server and client configuration files and process that can be reproduced locally, instead of a complicated client configuration file that has been stripped of sensitive data.
• I confirm that I have provided the simplest configuration that can be used to reproduce the error I reported, instead of depending on remote servers, TUN, graphical interface clients, or other closed-source software.
• I confirm that I have provided the complete configuration files and logs, rather than just providing parts I think are useful out of confidence in my own intelligence.