Yes. Let's Encrypt has issued certificates for IPv4 and IPv6 addresses since they became generally available on 15 January 2026. They are always short-lived, valid for 160 hours, and you request them by selecting the shortlived profile in an ACME client that supports profiles. Validation can use the HTTP-01 challenge.
What an IP address certificate is
A normal TLS certificate names a domain. An IP address certificate names an address in its Subject Alternative Name, so a client connecting to https and a raw IP can verify the server without any hostname. Let's Encrypt supports both IPv4 and IPv6.
The team requires these to be short-lived because IP addresses are more transient than domain names, so checking control more often is the safer design.
When it is worth using
| Situation | IP certificate helpful? |
|---|---|
| A service reached only by IP, such as an internal tool on a public address | Yes, avoids a throwaway hostname |
| A temporary or ephemeral server exposed directly | Yes, if the address is stable for days |
| A site users type by name | No, use a domain certificate |
| An address you rent briefly or share with others | Careful: you must control it at renewal time |
| A private RFC 1918 address | No, a public CA cannot validate it |
The last row is an inference from how public validation works: the validation servers must reach the address from the internet.
How validation works
The challenge types documentation says HTTP-01 can be used to validate IP addresses. The client places a token file under the well-known acme-challenge path on port 80, and Let's Encrypt fetches it, possibly from several vantage points. Port 80 must therefore be reachable at that address. HTTP-01 cannot issue wildcards, which is not an issue here.
Rate limits treat IPs specially. For IPv4, the exact address counts as the registered domain. For IPv6, the containing /64 range counts. So many certificates for addresses in one /64 share the same weekly allowance.
Steps
- Confirm the address is public, stable and under your control for the certificate lifetime.
- Use an ACME client that supports certificate profiles. Certbot documents six day and IP address certificates in a dedicated post.
- Request the shortlived profile and list the IP as the identifier.
- Make sure port 80 answers at that address for validation.
- Run renewal at least daily. Short-lived certificates should renew every two to three days, per the earlier announcement.
- Configure the client application to connect using the IP in the URL, and keep hostname checks on. See hostname verification and SANs.
Pitfalls
Do not disable certificate checks in the client because an IP "has no hostname." The certificate does carry the IP in its SAN, and verification should pass. Disabling it defeats the purpose, as discussed in what to do instead of turning verification off.
Do not assume the address stays yours. If a cloud provider reassigns the address after you release it, a still valid certificate for that IP could be a problem. Short lifetimes limit that exposure, and you should still tear things down deliberately.
Where Safeguard fits
Safeguard does not issue certificates. It scans your code and dependencies, including SBOM generation, so you know which TLS stack your service uses. Try the free scan at gold.safeguard.sh/scan.
Quick check
Can an IP certificate be long-lived?
No. Let's Encrypt states that IP address certificates must be short-lived, which means 160 hours.
Which challenge validates an IP address?
HTTP-01 can be used to validate IP addresses, according to the Let's Encrypt challenge types page.
Do IP certificates work with IPv6?
Yes. The announcement says both IPv4 and IPv6 are supported.
Sources
- Let's Encrypt, 6-day and IP Address Certificates are Generally Available
- Let's Encrypt, Challenge Types
- Let's Encrypt, Rate Limits
Last reviewed: 19 October 2026.
