diff --git a/ChangeLog.d/x509-programs-ip-san.txt b/ChangeLog.d/x509-programs-ip-san.txt
new file mode 100644
index 0000000000..a2e40ef032
--- /dev/null
+++ b/ChangeLog.d/x509-programs-ip-san.txt
@@ -0,0 +1,4 @@
+Bugfix
+   * Fix a stack buffer overflow in the cert_write and cert_req sample
+     programs when an IPv6 address is given in the san parameter. IPv6
+     addresses are now written correctly.
diff --git a/programs/x509/cert_req.c b/programs/x509/cert_req.c
index 73d712915a..7deb706653 100644
--- a/programs/x509/cert_req.c
+++ b/programs/x509/cert_req.c
@@ -66,7 +66,7 @@ int main(void)
     "                           DNS:value\n"            \
     "                           URI:value\n"            \
     "                           RFC822:value\n"         \
-    "                           IP:value (Only IPv4 is supported)\n" \
+    "                           IP:value (IPv4 or IPv6)\n" \
     "                           DN:list of comma separated key=value pairs\n" \
     "    key_usage=%%s        default: (empty)\n"       \
     "                        Comma-separated-list of values:\n"     \
@@ -153,7 +153,7 @@ int main(int argc, char *argv[])
     mbedtls_x509write_csr req;
     mbedtls_x509_san_list *cur, *prev;
 #if defined(MBEDTLS_X509_CRT_PARSE_C)
-    uint8_t ip[4] = { 0 };
+    uint8_t ip[16] = { 0 };
 #endif
     /*
      * Set to sane values
@@ -268,7 +268,7 @@ usage:
                         goto exit;
                     }
                     cur->node.san.unstructured_name.p = (unsigned char *) ip;
-                    cur->node.san.unstructured_name.len = sizeof(ip);
+                    cur->node.san.unstructured_name.len = ip_addr_len;
                 } else if (strcmp(q, "DN") == 0) {
                     cur->node.type = MBEDTLS_X509_SAN_DIRECTORY_NAME;
                     /* Work around an API mismatch between string_to_names() and
diff --git a/programs/x509/cert_write.c b/programs/x509/cert_write.c
index 947d73f54a..95dc7d902d 100644
--- a/programs/x509/cert_write.c
+++ b/programs/x509/cert_write.c
@@ -135,7 +135,7 @@ int main(void)
     "                             DNS:value\n"            \
     "                             URI:value\n"            \
     "                             RFC822:value\n"         \
-    "                             IP:value (Only IPv4 is supported)\n" \
+    "                             IP:value (IPv4 or IPv6)\n" \
     "                             DN:list of comma separated key=value pairs\n" \
     "    authority_identifier=%%s default: 1\n"             \
     "                            Possible values: 0, 1\n"   \
@@ -316,7 +316,7 @@ int main(int argc, char *argv[])
     size_t serial_len;
     mbedtls_asn1_sequence *ext_key_usage;
     mbedtls_x509_san_list *cur, *prev;
-    uint8_t ip[4] = { 0 };
+    uint8_t ip[16] = { 0 };
     /*
      * Set to sane values
      */
@@ -650,7 +650,7 @@ usage:
                         goto exit;
                     }
                     cur->node.san.unstructured_name.p = (unsigned char *) ip;
-                    cur->node.san.unstructured_name.len = sizeof(ip);
+                    cur->node.san.unstructured_name.len = ip_addr_len;
                 } else if (strcmp(q, "DN") == 0) {
                     cur->node.type = MBEDTLS_X509_SAN_DIRECTORY_NAME;
                     /* Work around an API mismatch between string_to_names() and