Let’s Encrypt Breaks New Ground: Free SSL Certs Now Issued for IP Addresses

Let’s Encrypt, operated by the Internet Security Research Group (ISRG), revolutionized the web in 2015 by providing free, automated digital certificates for domain names. Until now, however, those certificates could only be issued for Fully Qualified Domain Names (FQDNs), leaving a gap for services accessed via IP addresses — such as local servers, internal tools, or certain edge networking applications.

That changes with this new capability, which supports IP address-based certificates through the Automated Certificate Management Environment (ACME) protocol. This means users can now request and deploy HTTPS certificates for their IPs, using http-01 and tls-alpn-01 challenge types for validation. DNS challenges are not supported for IP-based issuance.

The development is part of a broader industry push toward end-to-end encryption by default, even in scenarios where domain names are not available or practical. Use cases include direct server access via IP, IoT networks, internal enterprise tools, and DNS-over-HTTPS endpoints — all of which can now be secured with minimal configuration or cost.

However, these IP certificates do come with limitations. They are short-lived certificates, valid for just 6 days, as opposed to Let’s Encrypt’s traditional 90-day certificate lifespan. This short validity period is part of an experimental rollout designed to reduce risk and encourage automation. Users will need to ensure that their ACME clients can handle the short renewal windows and support the appropriate challenge types.

As of now, IP address certificates are live in Let’s Encrypt’s staging environment, allowing developers and system administrators to begin testing the feature in preparation for general availability later in 2025.