Every IP address
already has a name.
Put an IP address in a hostname under ipssl.cc and it resolves to that address. Free, IPv4 and IPv6, no sign-up, and HTTPS certificates from any ACME CA.
Rust · hickory-dns · IPv4 + IPv6 · MIT
IPv4 Documentation address, reserved for examples.
- 203-0-113-10.ipssl.ccRecommended
- app-203-0-113-10.ipssl.ccWith a label
- 203.0.113.10.ipssl.ccDotted
- cb00710a.ipssl.ccHex
Looks the first name up through Cloudflare's public DNS over HTTPS.
- Browser
- Cloudflare DNS
- ns1–3.ipssl.cc
Write the address into the name.
Dots become dashes, so the whole address fits in one label. Anything in front of it is yours to choose.
app-Your label, optional203-0-113-10The address, dots written as dashes.ipssl.ccThe zone203.0.113.10
What it resolves to
| Name | Resolves to | Notes |
|---|---|---|
10-0-0-1.ipssl.cc | 10.0.0.1 | Recommended. One label, easiest to get certificates for |
app-10-0-0-1.ipssl.cc | 10.0.0.1 | Words before or after the address, joined with - |
10-0-0-1-app.ipssl.cc | 10.0.0.1 | |
app.10-0-0-1.ipssl.cc | 10.0.0.1 | Any number of subdomain levels |
10.0.0.1.ipssl.cc | 10.0.0.1 | Dotted form |
app.10.0.0.1.ipssl.cc | 10.0.0.1 | |
0a000001.ipssl.cc | 10.0.0.1 | Eight hex digits |
2001-db8--1.ipssl.cc | 2001:db8::1 | IPv6: write : as - and :: as -- |
app.2001-db8--1.ipssl.cc | 2001:db8::1 | Words in front of an IPv6 address go in their own label |
Real certificates, issued to your own server.
The name resolves to your server, so an ACME client running there passes HTTP-01 or TLS-ALPN-01 validation as it would for any other domain. There is nothing to sign up for, and the private key never leaves your machine.
- Any CA. The zone publishes no CAA record, so Let's Encrypt, ZeroSSL, Google Trust Services and others can all issue.
- Public addresses only. The CA has to reach your server, so private addresses such as
192.168.1.10cannot be validated. - One shared limit. Every name under ipssl.cc counts toward Let's Encrypt's rate limit for the registered domain. If you hit it, try again later or use another CA.
sudo certbot certonly --standalone \
-d 203-0-113-10.ipssl.ccacme.sh --issue --standalone \
-d 203-0-113-10.ipssl.cc# Caddyfile
203-0-113-10.ipssl.cc {
reverse_proxy localhost:8080
}Uses the first name from the converter. Run it on the server that owns the address.
Answered by three name servers in three regions.
Each one answers over UDP and TCP on port 53, on IPv4 and IPv6, running the same open source server.
-
ns1.ipssl.ccTokyo191.223.220.592403:18c0:1000:33e:c483:bbff:fe27:42c3 -
ns2.ipssl.ccUnited States45.59.187.412605:52c0:3:1c4:be24:11ff:fe87:11f7 -
ns3.ipssl.ccHong Kong191.223.218.372403:18c0:5:b56:be24:11ff:fe0e:1a61
- Rate limited, never cut off
- UDP answers are limited per client network so the servers cannot be used to flood someone else. A resolver that gets a truncated answer retries over TCP, which is never limited.
- No query logs
- The servers keep aggregate counters only, such as how many A queries they answered. Query names and client addresses are not logged.
- Small, written in Rust
- An authoritative server built on hickory-dns. Config changes load without dropping a query.
Questions
Something missing? Ask in the issue tracker.
Why doesn't a private address resolve on my network?
Many routers (OpenWrt, pfSense, dnsmasq, Fritz!Box and others) have DNS rebinding protection, which drops answers that point to private addresses. Allowlist ipssl.cc there, or use a public resolver.
Can I download a wildcard certificate for ipssl.cc?
No. Publishing a private key breaks the CA's subscriber agreement, and anyone holding the key could revoke the certificate. Get a certificate on your own server instead; it takes one command.
Why isn't ipssl.cc on the Public Suffix List?
The list excludes services that resolve an IP address written in a hostname to that address: the same IP can belong to different people over time, so it does not show stable control of a name. DNS resolution does not depend on the list.
How do I see where my DNS queries come from?
Run dig +short TXT ip.ipssl.cc. The answer is the address the query reached us from, which is usually your recursive resolver.
Can I run this for my own domain?
Yes. The server is open source under the MIT license, and the install script below sets it up on any Linux server. The README covers the config and the registrar setup.
How do I report abuse?
Open an issue on GitHub with the name and what it is used for. The server has a blocklist, so names used for abuse can stop resolving.
Run it for your own domain.
The install script downloads a static Linux binary, checks it against the release checksums and sets up a systemd service.
curl -fsSLO \
https://raw.githubusercontent.com/gonolab/ipssl.cc/main/deploy/install.sh
sudo sh install.sh