> (often with direct ip instead of domain name, so no https there anyway).

That's not true, one can have IP addresses in certificates, it's just very rare because virtual hosting makes "single IP" services rare nowadays: https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.6 ("Defined options include an Internet electronic mail address, a DNS name, an IP address, and a Uniform Resource Identifier (URI).") OpenSSL uses "IP:" syntax in their subjectAltName field (e.g. https://mta.openssl.org/pipermail/openssl-users/2016-Septemb... ) and the CAB seems to be on-board, subject to some "well, watch out for ..." language https://cabforum.org/working-groups/server/guidance-ip-addre...

So do CAs in general offer those? Are they as affordable as "normal" certs? Certainly you need to be paying for that those kind of certificates, possibly some premium?

It's probably not worth it anyway, because you're now stuck with that single IP, for little benefit. In general IPs just don't get HTTPS certificates acquired for them.

Seems to be free from ZeroSSL https://help.zerossl.com/hc/en-us/articles/360060119973-Is-I... but Letsencrypt decided against it since their whole thing is about proving ownership over a domain, or set of domains, and doing that for an IP address would be some nonsense. I would be absolutely shocked if the "name brand" cert issuers don't support CSRs containing iPAddress SAN entries, since it's very clearly part of the RFC, but I haven't ever had a need to try such a stunt, either

you can get a free cert from ZeroSSL for an IP address

https://help.zerossl.com/hc/en-us/articles/360060119973-Is-I...

> (often with direct ip instead of domain name, so no https there anyway).

Real-world counter example of an IP address available over https:

https://1.1.1.1

I guess I stand corrected on the ip / https thing :)