Alter Ego: Identifying Web Server Certificates Containing IP Addresses As Subjects

This study is concerned with the security implications of Web IP certificates, a particular category of web server certificates in which the subject is represented by an IP address in place of a fully qualified domain name (FQDN). Web IP certificates permit clients to verify the server in question by means of its IP address; however, they also present a number of significant risks. In particular, if a Certificate Authority (CA) issues a Web IP certificate without adequately verifying the server’s ownership or usage rights of the IP address, it could permit unauthorized third parties to obtain certificates for IP addresses they do not control. To date, no comprehensive survey has been conducted to examine the prevalence and characteristics of such certificates. To address this gap in the paper, we conducted a large-scale survey, establishing TLS connections to all IPv4 addresses, with the objective of collecting certificates and analyzing the presence and features of Web IP certificates.