Include server IP Address for the main web server helps with non SNI Browsers?

Let’s Encrypt only issues certificates for DNS names, not IP addresses.

I’m a bit confused by your description though, why would a certificate for a IP address help with non-SNI clients? Would you tell those clients to access your server by IP address?

If a client doesn’t support SNI, web servers generally pick the default certificate (for example on nginx, that would be the certificate specified for the default server). As long as your default certificate includes the domain with the most hits (i.e. the one you care most about), that one should continue to be served for non-SNI clients.

Depending on how many domains per IP/server we’re talking about here, you could also just create SAN certificates where you use the same certificate for all your domains (up to 100). This would not require SNI support. The client supports this by passing multiple -d arguments.

4 Likes