3 ms·

TLS certs can be issued to make them work with IP addresses, which is why https to 8.8.8.8 (octal: 010.010.010.010) works: https://cabforum.org/guidance-ip-addr

• tialaramex 5y ago
  Not explicitly mentioned in that CAB/F document, the PKIX standard that makes ipAddress SANs work actually defines them as numeric types with a set number of bits, so an ipAddress is literally a 32-bit or 128-bit value. This leaves no room for the ambiguity of the text rendering something like 010.010.010.010 in the certificate itself. Likewise the dnsName SAN type is defined in an alphabet for X.509 that literally can't represent fancy Unicode, so you can't mistakenly write certificates with dnsName SANs that give the Unicode name instead of the unambiguous punycode name stored in DNS. These two choices mean your browser can mechanically with 100% reliability check certificates in the Web PKI match the IP address or DNS name from the URL you believed you were visiting, whereas historically the abuse of "Common Name" features to write a human representation had nasty edge cases for both IP addresses and some DNS names.