TLS certs for IP addresses for providers who change them?

[ski192man]

@ell1e

However, I don't think the average IP address allows a CAA entry, and even if it did, it would be controlled by the hoster in question. So now the hoster could simply get an IP address cert via let's encrypt instead, intercept the traffic, and answer any TLS requests with that cert. While browsers may insist on the correct vhost, I assume many other TLS software will not.

The browser would have to request the IP address. If you request https://google.com but get served a certificate for the IP address, you will receive an error because google.com is not a listed SAN

If software doesn't properly check SANs I would consider that a catastrophic vulnerability