3

Is it possible to acquire a SSL Certificate for a static IP address that is not registered to a domain name and is there any issues that could be encountered?

2 Answers 2

6

Main problem with a certificate for a static IP address is that it may very well not work at all. Relevant standards (RFC 2818, RFC 6125) only talk about DNS names, not IP addresses.

There are mostly two ways in which an IP address could be stored in a certificate's Subject Alt Name extension: either directly under its normal ASN.1 type (iPAddress, an OCTET STRING of length 4 or 16, depending on whether you are talking about IPv4 or IPv6), or as a dNSName by converting the address to its decimal-dotted representation (as in "1.2.3.4", a sequence of seven characters to encode a 4-byte IP address). I heard, but not verified myself, that some versions Internet Explorer would accept to match the second kind of representation as if it was a name, but not all browsers would do that. The iPAddress format is likely to be completely ignored by clients.

Usual commercial CA won't accept to encode IP addresses in certificates, in particular because they cannot guarantee that the IP address is yours and will remain yours, regardless of how strongly you believe it.

3
  • From my experience all versions of IE will need the IP address as dNSName while every other browser needs to have it as iPAddress. Most browsers support IP in CN too, but Safari does not. Commented Oct 28, 2015 at 18:01
  • It is out of RFC and not supported so while it can work in certain conditions, it is not a supported process for most CAs.
    – user89449
    Commented Oct 28, 2015 at 19:23
  • RFC 6125 does discuss IP addresses in server certificates: IP addresses are not necessarily reliable identifiers for application services because of the existence of private LANs, host mobility, multiple interfaces, NATs ... etc. Most fundamentally, most users find DNS domain names much easier to work with than IP addresses, which is why the domain name system was designed in the first place. We prefer to define best practices for the much more common use case and not to complicate the rules in this specification.
    – GLRoman
    Commented Feb 24, 2022 at 0:42
5

At least it is, apparently, possible to obtain said certificate for an IP address which has a domain registered to it: https://1.1.1.1/ .

Signature Algorithm: ecdsa-with-SHA256
    Issuer: C=US, O=DigiCert Inc, CN=DigiCert ECC Secure Server CA
    Subject: C=US, ST=CA, L=San Francisco, O=Cloudflare, Inc., CN=*.cloudflare-dns.com
        X509v3 Subject Alternative Name:
            DNS:*.cloudflare-dns.com, IP Address:1.1.1.1, IP Address:1.0.0.1, DNS:cloudflare-dns.com, IP Address:2606:4700:4700:0:0:0:0:1111, IP Address:2606:4700:4700:0:0:0:0:1001

As you can see, four IP addresses (two from the IPv4 address family and two other from the IPv6 one) are encoded in the Subject Alternative Name field as values of iPAddress ASN.1 type. It turns out in 2018 most browsers are capable of understanding this.

It's still unclear though what policies does CA/Browser Forum suggest for such a case. Traditional policy implies there's a domain, not an IP address, written into a certificate. Also, if any information in a certificate becomes incorrect or inaccurate it should be revoked. A traditional certificate authority is expected to track the domain name ownership, however, IP address transition is another story: there's no such thing as an IP address "owner", and data sources for the IP network usage are not the same as in the DNS world, so it's much more complicated.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .