All tools

Guides Certificates

Let’s Encrypt certificates for IP addresses

Updated 4 min read

Short answer

Yes: since January 15, 2026, Let’s Encrypt issues publicly trusted certificates for IP addresses, IPv4 and IPv6. They come only with the shortlived profile and last 160 hours, just over six days.

You prove control over HTTP on port 80 or TLS on port 443, never DNS, and your client must support profiles: Certbot 5.4.0 or later (5.3.0 for the standalone or manual plugins), lego 4.22.0 or later, or acme.sh 3.1.2 or later.

What to do: request one from the staging server first, then automate renewal and make sure the server reloads each new certificate.

Expiry Watch checks domain names, not IP addresses. For the certificates on your domains, it emails you when a renewal looks late or expiry gets close. Free, with no account. Watch a domain

What you get

Let’s Encrypt announced general availability on January 15, 2026: “Short-lived and IP address certificates are now generally available.” It had issued its first IP address certificate on July 1, 2025, on a limited basis. The rules:

  • Short-lived only. “IP address certificates must be short-lived certificates, a decision we made because IP addresses are more transient than domain names.” They are valid for 160 hours.
  • IPv4 and IPv6. “Let’s Encrypt supports both IPv4 and IPv6.”
  • HTTP or TLS validation only. “You can’t use the DNS challenge method to prove your control over an IP address; only the http-01 and tls-alpn-01 methods can be used.” That means port 80 or port 443 on that address must answer the CA.
  • A client that can choose a profile. Your ACME client “must support the draft ACME Profiles specification, and you must configure it to request the shortlived profile.”

Let’s Encrypt’s profiles page lists the shortlived profile with a validity period of 160 hours, identifier types “DNS, IP”, up to 25 names, and an authorization reuse period of 7 hours. The default classic profile accepts DNS names only.

Request one with Certbot

Certbot added --ip-address in 5.3.0 (February 3, 2026), for the standalone and manual plugins, and webroot support in 5.4.0 (March 10, 2026). The --preferred-profile option dates from 4.0.0. Let’s Encrypt and Certbot’s team give this command, against staging first (Six-Day and IP Address Certificates Available in Certbot):

sudo certbot certonly --staging \
  --preferred-profile shortlived \
  --webroot \
  --webroot-path <filesystem path to webserver root> \
  --ip-address <your ip address>

Once it works, run it again without --staging for a trusted certificate. Then:

  • Point the server at the files yourself. Certbot can get IP address certificates but not yet install them: “The nginx and apache plugins don’t yet support IP addresses.” Use /etc/letsencrypt/live/<ip address>/fullchain.pem and privkey.pem.
  • Add a deploy hook, so each renewal reloads the server. The same post suggests setting it with certbot reconfigure; site still shows the old SSL certificate has hooks for nginx, Apache and HAProxy.
  • Check the timer. A six-day certificate leaves no room for a renewal job that quietly stopped. Is Certbot auto-renewal working? shows how to check it.

Other clients

  • lego can request a profile with --profile since v4.22.0 (February 17, 2025), and has accepted IP addresses since v4.11.0 (May 2, 2023).
  • acme.sh added “cert profile and ip cert” support in 3.1.2 (November 29, 2025). Its option is --cert-profile.

Check your client’s documentation for the exact syntax, and test against staging first.

What you can’t get

  • A certificate for a private address. The CA/Browser Forum’s rules forbid it: “CAs SHALL NOT issue Certificates containing Internal Names or Reserved IP Addresses” (Baseline Requirements, section 4.2.2). That includes 10.0.0.0/8, 192.168.0.0/16 and the other ranges in IANA’s special-purpose registries. A test order we sent to Let’s Encrypt’s staging server for 192.168.1.10 on October 24, 2026 came back with:
Cannot issue for "192.168.1.10": IP address is in a reserved address block: [RFC1918]: Private-Use
  • A longer lifetime. Only the shortlived profile allows IP addresses, so there is no 45- or 90-day option.
  • DNS validation, or a wildcard. Without DNS-01 there is no way to validate a wildcard, and wildcards are for domain names anyway.

Renewal every few days

Certbot’s rule for short certificates applies: for a lifetime shorter than 10 days, it renews when half the lifetime is left (Certbot User Guide), so about 80 hours into a 160-hour certificate. Its twice-daily timer is frequent enough for that. From Certbot 4.1.0, the CA’s suggested renewal window (ARI) takes precedence when Let’s Encrypt provides one.

The address also has to keep answering validation on port 80 or 443 at every renewal. If the IP address changes, as residential addresses often do, the certificate can’t follow it: you need a new one for the new address.

What they’re for

Let’s Encrypt lists the uses it knows of: a default page for hosting providers when someone types a server’s IP address, sites with no domain name, DNS over HTTPS and other infrastructure services, home devices such as network storage, and short-lived connections between cloud servers. For anything people visit by name, a certificate for the name remains the better fit: names survive moving to new servers, and addresses don’t.

Sources

All sources were checked on October 24, 2026. The staging answer comes from our own test order on that date.

Keep reading