Who benefits from this? Even though Let’s Encrypt stresses that most site operators will do fine sticking with ordinary domain certificates, there are still scenarios where a numeric identifier is the only practical choice:
Infrastructure services such as DNS-over-HTTPS (DoH) – where clients may pin a literal IP address for performance or censorship-evasion reasons.
IoT and home-lab devices – think network-attached storage boxes, for example, living behind static WAN addresses.
Ephemeral cloud workloads – short-lived back-end servers that spin up with public IPs faster than DNS records can propagate.
What do you mean?
In much simpler terms:
Think of an IP address like a street address. 192 My Street.
There might be multiple businesses at one street address. In real life we address them with things like 1/192 My Street and 2/192 My Street, but there’s no direct parallel to that in computer networks. Instead, what we do is more like directing your letter to say “Business A c/o 192 My Street”. That’s what SNI does.
Because we have to write all of that on the outside of the envelope, everyone gets to see that we’re communicating with Business A. But what if one of the businesses at 192 My Street is highly sensitive and we’d rather people didn’t know we were communicating with them? @bjoern_tantau@swg-empire.de’s proposal is basically like if you put the “Business A” part inside the envelope, so the mailman (and anyone who sees the letter on the way) only see that it’s going to 192 My Street. Then the front room at that address could open the envelope and see that the ultimate destination is Business A, and pass it along to them.
There’s Encrypted Client Hello, supported by major browsers that does the SNI encryption. It’s starting to be fairly widely supported.
Except that with street addresses there is such a lack of inconsistency on how they work and are written that it is funny
Currently before establishing an encrypted connection to a webserver the domain is sent to the webserver unencrypted so that the server can choose the appropriate certificate to use for encryption. That is called SNI, Server Name Indication.
Of course that’s a privacy risk. There are finally protocols to fix this but they aren’t very widespread and depend on DNS over HTTPS.
I think issuing certificates based on the IP and sending the domain name encrypted based on that certificate could have fixed this issue ages ago.