# Public domain name with private IP address ... should it work?

**URL:** <https://community.letsencrypt.org/t/public-domain-name-with-private-ip-address-should-it-work/94656>\
**Category:** Issuance Tech\
**Created:** [May 28, 2019, 2:49pm UTC](https://community.letsencrypt.org/t/public-domain-name-with-private-ip-address-should-it-work/94656 "2019-05-28T14:49:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dbryanbio](https://avatars.discourse-cdn.com/v4/letter/d/54ee81/32.png) [@dbryanbio](https://community.letsencrypt.org/u/dbryanbio)\
**Post date:** [May 28, 2019, 2:49pm UTC](https://community.letsencrypt.org/t/public-domain-name-with-private-ip-address-should-it-work/94656/1 "2019-05-28T14:49:11Z")

</div>

Hello!

Early in my Let’s Encrypt journey I added a domain with a private IP address to a cert that had several other domains.  
So one certificate covers these domains:  
[host1.example.com](http://host1.example.com) (public IP address)  
[host2.example.com](http://host2.example.com) (public IP address)  
[host3.example.com](http://host3.example.com) (public IP address)  
**[host4.example.com](http://host4.example.com) (private IP address: 172.31.X.Y)**

This has been working to provide https access for an internal component.  
But I have become aware that this is non-standard, and possibly, impossible.  
Is it supposed to work? How alarmed should I be about this usage?

(I checked some other topics and didn’t find this specific scenario)  
Thanks!

---

<div class="post-metadata">

**Author:** ![rmbolger](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rmbolger/32/27474_2.png) [@rmbolger](https://community.letsencrypt.org/u/rmbolger)\
**Post date:** [May 28, 2019, 3:01pm UTC](https://community.letsencrypt.org/t/public-domain-name-with-private-ip-address-should-it-work/94656/2 "2019-05-28T15:01:10Z")

</div>

Names in a cert that resolve to private IP addresses only matter if you’re trying to use a challenge type that requires the Let’s Encrypt server to actually reach that hostname (http-01 or any of the tls-\* ones). But if you use dns-01, the IP that names resolve to is irrelevant as long as the Let’s Encrypt servers can reach your authoritative DNS servers.

The final cert knows nothing about the IP addresses a name resolves to. You can freely change the IPs that the names resolve to even after you’re using the cert.

---

<div class="post-metadata">

**Author:** ![mproto](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mproto/32/20185_2.png) [@mproto](https://community.letsencrypt.org/u/mproto)\
**Post date:** [May 28, 2019, 4:46pm UTC](https://community.letsencrypt.org/t/public-domain-name-with-private-ip-address-should-it-work/94656/3 "2019-05-28T16:46:26Z")

</div>

Yeah if you have a mix of internal and external hosts your best bet is to get a wildcard certificate via the dns-01 challenge/response.

---

<div class="post-metadata">

**Author:** ![dbryanbio](https://avatars.discourse-cdn.com/v4/letter/d/54ee81/32.png) [@dbryanbio](https://community.letsencrypt.org/u/dbryanbio)\
**Post date:** [May 28, 2019, 4:53pm UTC](https://community.letsencrypt.org/t/public-domain-name-with-private-ip-address-should-it-work/94656/4 "2019-05-28T16:53:17Z")

</div>

Ok, that makes sense. Thank you very much for your reply!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [June 27, 2019, 4:53pm UTC](https://community.letsencrypt.org/t/public-domain-name-with-private-ip-address-should-it-work/94656/5 "2019-06-27T16:53:18Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.