Hacker News Reader

With IP addresses, it is not possible to validate TLS certificate as well. This should not work at all.

Also we have HTTPS everywhere, but DKIM is still not supported by most domains. That is a more serious issue and it also covers this as well.

View on HN

> With IP addresses, it is not possible to validate TLS certificate as well. This should not work at all.

Technically the CA/B forum hasn't outlawed TLS certificates for IP addresses, and a few live ones exist.

https://1.1.1.1 plus https://[2606:4700:4700::1111]/

https://crt.sh/?q=8.8.8.8

https://8.8.8.8/test

You can get an IP address as a SAN, but that doesn't mean much because unless configured to do so, most email servers will not validate and reject invalid certificates on a destination mail server.

Reply on news.ycombinator.com