IP SSL certificate
One command to get a free, trusted HTTPS certificate for your server's IP address from Let's Encrypt, no domain needed; installed and renewed automatically.
Run as root on your server
bash <(curl -sL ipk.me/ssl) -l en 216.73.217.175 -l en | Report language (follows this page) |
-4 / -6 | IPv4 or IPv6 only |
-w /var/www/html | Validate through your web server's root directory instead of a temporary server on port 80 |
-r "systemctl reload nginx" | Command to run after each renewal (default: reload nginx / Apache / Caddy if running) |
-d /etc/ssl/ipk | Where to install the certificate files |
-y | Do not ask before stopping the web server on port 80 |
--alpn | Validate over port 443 (TLS-ALPN-01) instead of port 80 |
--staging | Use Let's Encrypt's test environment (untrusted certificate, for trying it out) |
203.0.113.10 2001:db8::10 | IP addresses to include. Without them the server's outbound IPv4 / IPv6 is used, and if it has more public IPs you are asked which ones to include |
How it works
- A built-in ACME client (just bash, openssl and curl; python3 for the temporary validation server) requests the certificate with Let's Encrypt's short-lived profile: IP certificates are valid for about 6 days and are renewed every 3 days.
- Validation goes over port 80 (HTTP-01), so port 80 of the IP must be reachable from the internet; before issuing, ipk.me checks this from outside.
- Port 80 blocked? Port 443 also works (TLS-ALPN-01): add --alpn; it is also chosen automatically when only port 443 is reachable. IP certificates cannot be validated through DNS.
- After issuing, the certificate and key paths and the validity period are printed; a copy of the script is kept in /etc/ssl/ipk and a daily renewal job is added to crontab.
- If nginx, Apache or Caddy is using port 80 / 443, it is stopped for a few seconds while issuing and renewing; use -w to avoid that.
- IPv4 and IPv6 go into one certificate. Private and CGNAT addresses cannot get one. In mainland China, cloud providers often block port 80 on servers without ICP filing.
- Works on Linux. Only your IP addresses are sent to ipk.me; the private key never leaves your server.