According to the CAB baseline requirements it doesn't look like you need to prove ownership of the IP address to get a certificate for it.

https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-... (section 3.2.2.5.1)

> section 3.2.2.5.1

There is no such section?

Almost all modern documents about certificate policy have the same structure, a structure described in RFC 3647. This makes it easier to find what you're looking for in somebody else's policy document and to verify they ticked all the boxes. If they've got a rule about Certificate Revocation for example that'll go in section 4.9.

So there's going to be a section 3 about "Identification and Authentication" and it's going to have a subsection 3.2 "Initial Identity Validation" and that's going to have a sub-subsection 3.2.2 about how we figure out who this actually is we're talking to, and so these sections will be further divided. 3.2.2.4.x is the "Ten Blessed Methods" (these days there are rather more than ten) for how we validate DNS names in the Web PKI).

searching for "3.2.2.5.1" works just fine in firefox's pdf.js. For reference it's on page 40