IP addresses aren't sent in SNI

[ericlaw1979]

Browsers shouldn't be sending an IP address in a SNI, and LetsEncrypt, as far as I know, should refuse to issue a certificate for an IP address.

[ericlaw1979]

Similar issue if the client requests an unqualified hostname (no dots)?

[dakami]

Ah, I sort of assumed these would be covered by the regex. They're not?

[ericlaw1979]

Regex's are hard to read. :)

^((?!-)[A-Za-z0-9-]{1,63}(?<!-).)+[A-Za-z]{2,6}$ does indeed reject both of those cases, although it does mean that you cannot use an IP address to access the site.

The regex (arguably incorrectly) allows "538.com" and disallows "www.something.bargains"