# What Is IP Address Certificate (IP SSL certificate)?

> IP address certificates are TLS certificates whose SAN lists IP addresses, so clients can verify a server reached by IP rather than by domain name.

Source: https://ssl.sh/glossary/ip-address-certificate/
Last updated: 2026-11-10

An IP address certificate carries one or more `iPAddress` entries, IPv4 or IPv6, in its [Subject Alternative Name](https://ssl.sh/glossary/san/) extension. When a client connects to `https://203.0.113.10/`, it checks that exact address against those entries; an IP written as a DNS name or in the Common Name does not count. Publicly trusted CAs may issue them only for public addresses the applicant controls, never for private or reserved ranges such as 10.0.0.0/8 or 192.168.0.0/16. Clients do not send SNI when connecting to an IP literal, as RFC 6066 forbids it, so a server returns its default certificate for that address and port.

## Why it matters
Some services have no domain name: DNS-over-HTTPS resolvers, device setup pages, temporary servers and infrastructure endpoints. Since 2026-01-15 [Let's Encrypt](https://ssl.sh/glossary/let-s-encrypt/) has offered IP address certificates generally through its shortlived profile, so they are six-day (160-hour) certificates that must be renewed automatically. Validation has to use [http-01](https://ssl.sh/glossary/http-01/) or tls-alpn-01, because dns-01 relies on DNS records that a bare IP address does not have.

## Example
```bash
openssl s_client -connect 203.0.113.10:443 </dev/null 2>/dev/null \
  | openssl x509 -noout -ext subjectAltName
```

```text
X509v3 Subject Alternative Name:
    IP Address:203.0.113.10
```

## Common misconceptions
- **Putting the IP in the Common Name is enough.** Clients match IP addresses only against `iPAddress` SAN entries.
- **You can get a public certificate for 192.168.1.1.** Private and reserved addresses cannot be validated by a public CA; use a private CA.
- **An IP certificate also covers domains that point to that IP.** Each name must be listed separately; the IP entry matches only connections made to the address itself.

## Related terms

- [SAN](https://ssl.sh/zh/glossary/san/): SAN 即主体备用名称，是 X.509 证书中列出其适用的所有域名、IP 地址等身份的扩展，客户端按它校验主机名。
- [短期证书](https://ssl.sh/zh/glossary/short-lived-certificate/): 短期证书是有效期只有几天的 TLS 证书，靠快速过期而不是吊销来限制被盗证书可被滥用的时间。
- [HTTP-01](https://ssl.sh/zh/glossary/http-01/): HTTP-01 是一种 ACME 验证方式，客户端通过 80 端口以普通 HTTP 提供 CA 指定的令牌内容来证明域名控制权。
- [TLS-ALPN-01](https://ssl.sh/zh/glossary/tls-alpn-01/): TLS-ALPN-01 是一种 ACME 验证方式，服务器在 443 端口针对 acme-tls/1 协议出示一张特殊证书来证明域名控制权。
- [Let's Encrypt](https://ssl.sh/zh/glossary/let-s-encrypt/): Let's Encrypt 是由非营利组织 ISRG 运营的免费、自动化证书颁发机构，通过 ACME 协议签发域名验证型 TLS 证书。
- [ACME Profile](https://ssl.sh/zh/glossary/acme-profile/): ACME Profile 是 CA 在 ACME 目录中公布的命名证书模板，客户端下单时选择它来决定证书的有效期和内容。
- [私有 CA](https://ssl.sh/zh/glossary/private-ca/): 私有 CA 是企业为自己的系统和设备搭建的证书颁发机构，其根证书只在企业主动安装的设备上受信任。