Issuing SSL certificate for an IP address

Quite frequent question: is it possible to issue an SSL certificate for an IP address (and not for a domain name)? Yes, it is possible. However, there are several requirements:

• Only OV SSL certificates can be issued;
  
• The company must own IP address (validation based on WHOIS information of IP-addresses).
  

Trusted certification authorities are not issuing DV SSL certificates (with domain verification) for IP-addresses; because it creates certain security threats (IP-address can be non-unique), as well as, they are not issuing EV SSL certificate for IP address due to high security risks.

Update 07/05/2021: some DV SSL certificates (with domain verification) can now be issued for IP addresses as well. As an example, you can order the following IP certificates from us:

• PositiveSSL
  
• PositiveSSL Multidomain
  

In order to have an SSL certificate issued for an IP address instead of domain name, it needs to be specified in the appropriate field in order application form.

SSL industry regulator CA/B Forum guidance for using IP addresses

CA/B Forum, an SSL industry regulator, sets the following requirements of using IP addresses in SSL certificates:

• If the X.509 v.3 certificate contains an IP address, then it must be included in the SAN extension as the iPAddress name (not dNSName).
  
• A certificate may include multiple IP addresses 
  

There are some problems with handling iPAddress in the SAN in Windows® prior to version 10. To cope with these issues, you must add an IP address to the outdated commonName field of the X.509 v.3 certificate. If the certificate contains an IP address in the SAN extension with iPAddress and in commonName, then the certificate check will succeed. It is worth noting that downside of this implementation is inability to include multiple IP addresses in the common name of single certificate. 

If you need an SSL certificate for an IP address, you can always order it in our store. Moreover, we have an LIR status with RIPE NNC, therefore you can always rent an IPv4 and IPv6 addresses from us.