lets encrypt doesnt issue ip based certificates.
https://www.digicert.com/internal-names.htm
if you connect VIA ip then self signed certificates or an openssl based CA is probably the best way to go
otherwise something like a VPN or an SSH tunnel might be a better idea