IP Address Certificate (IP SSL certificate)
Definition
IP address certificates are TLS certificates whose SAN lists IP addresses, so clients can verify a server reached by IP rather than by domain name.
An IP address certificate carries one or more iPAddress entries, IPv4 or IPv6, in its Subject Alternative Name extension. When a client connects to https://203.0.113.10/, it checks that exact address against those entries; an IP written as a DNS name or in the Common Name does not count. Publicly trusted CAs may issue them only for public addresses the applicant controls, never for private or reserved ranges such as 10.0.0.0/8 or 192.168.0.0/16. Clients do not send SNI when connecting to an IP literal, as RFC 6066 forbids it, so a server returns its default certificate for that address and port.
Why it matters
Some services have no domain name: DNS-over-HTTPS resolvers, device setup pages, temporary servers and infrastructure endpoints. Since 2026-01-15 Let's Encrypt has offered IP address certificates generally through its shortlived profile, so they are six-day (160-hour) certificates that must be renewed automatically. Validation has to use http-01 or tls-alpn-01, because dns-01 relies on DNS records that a bare IP address does not have.
Example
openssl s_client -connect 203.0.113.10:443 </dev/null 2>/dev/null \
| openssl x509 -noout -ext subjectAltName
X509v3 Subject Alternative Name:
IP Address:203.0.113.10
Common misconceptions
- Putting the IP in the Common Name is enough. Clients match IP addresses only against
iPAddressSAN entries. - You can get a public certificate for 192.168.1.1. Private and reserved addresses cannot be validated by a public CA; use a private CA.
- An IP certificate also covers domains that point to that IP. Each name must be listed separately; the IP entry matches only connections made to the address itself.