Some services connect to each other by IP address rather than hostname — embedded devices, Kubernetes pod-to-pod communication, or internal service meshes that bypass DNS. Standard certificates only cover DNS names, which means those connections either run without TLS or with self-signed certificates. TigerTrust lets you include IP addresses directly in the Subject Alternative Names (SANs) so you can issue properly-trusted certificates for IP-addressed endpoints.

​
What it is

When issuing or importing a certificate, you can supply IPv4 and IPv6 addresses alongside DNS names in the SANs field. TigerTrust validates each address, stores it correctly according to the certificate standard, and passes it to your internal CA for signing. The certificate detail page renders IP SANs with an IP badge so you can instantly distinguish address-based from name-based certificates in your inventory.

​
When to use it

  • Issue mTLS certificates for Kubernetes pods that communicate by pod IP rather than service DNS name.
  • Provision certificates for embedded devices or PLCs that have a fixed IP but no DNS registration.
  • Secure internal load balancers or health-check endpoints that clients reach by IP address.
  • Replace self-signed certificates on internal appliances with properly CA-signed certificates that include the appliance’s IP address.

​
Set it up

1

Open the issue wizard

Go to Certificates > Issue and select your internal CA. IP SAN certificates must be issued by a private CA — public CAs do not issue certificates for IP addresses.
2

Add IP addresses to SANs

In the Subject Alternative Names field, add the IP addresses alongside any DNS names. The wizard accepts dotted-decimal IPv4 (for example, 10.0.1.42) and colon-separated IPv6 (for example, 2001:db8::1). IP entries are highlighted in blue.
3

Review the CA requirement tooltip

Hover over a blue IP entry to see the tooltip confirming that an internal CA is required. If you have not yet selected a private CA, the wizard will prompt you to do so before proceeding.
4

Complete the issue flow

Finish the wizard normally. The resulting certificate appears in your inventory with the IP badge next to each IP address SAN on the detail page.

​
What you’ll see

In the certificate detail page, SANs are listed in two groups — DNS names and IP addresses. IP addresses carry an IP badge. The inventory list shows all SANs in the SANs column, with IP addresses included. Filters on the inventory page treat IP SANs as searchable values.
Most public CAs (Let’s Encrypt, DigiCert, and others) do not issue certificates with IP address SANs. You must use an internal CA configured in TigerTrust PKI Core or a supported private CA integration for these certificates.

CSR-Only Signing

IP SANs present in an uploaded CSR are forwarded automatically.

PKI Core

The internal CA that can issue IP SAN certificates.

Certificate Issuance

Full issuance flow and SAN configuration.