A flaw was found in Dogtag PKI's ACME responder. The HTTP-01 challenge validator accepts IP address literals (e.g. 127.0.0.1) as dns identifiers without validating that the target address is public. Combined with the default Apache HttpClient behavior of following HTTP redirects, an unauthenticated ACME account holder can force the Dogtag server to send HTTP GET requests to arbitrary internal HTTP endpoints (loopback, link-local, RFC 1918, cloud metadata). When the InMemory database backend is used, the full HTTP response body of the internal target is included in the ACME challenge error and returned to the client, enabling the attacker to read internal HTTP responses. On DS/LDAP and PostgreSQL backends, the SSRF still occurs but the response body is only written to server logs, not returned to the client. The vulnerability exists because ACMEIdentifierValidator.validateSyntaxDNS() treats IP octets as valid DNS labels, ACMEPolicy.validateIdentifier() does not filter non-public addresses, and HTTP01Validator.getResponse() uses HttpClients.createDefault() which follows redirects without validating the destination address.