# mTLS matching IP address

**URL:** <https://forums.foundationdb.org/t/mtls-matching-ip-address/3291>\
**Category:** Using FoundationDB\
**Created:** [April 29, 2022, 8:59pm UTC](https://forums.foundationdb.org/t/mtls-matching-ip-address/3291 "2022-04-29T20:59:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![doublemax](https://avatars.discourse-cdn.com/v4/letter/d/8e7dd6/32.png) [@doublemax](https://forums.foundationdb.org/u/doublemax)\
**Post date:** [April 29, 2022, 8:59pm UTC](https://forums.foundationdb.org/t/mtls-matching-ip-address/3291/1 "2022-04-29T20:59:36Z")

</div>

Is it possible to check if the IP-address matches the client-ip?

E.g. Cerficicate for the client `10.1.2.3`:

```auto
openssl ... -addext "subjectAltName=IP:10.1.2.3"

```

Something like:

```auto
tls_verify_peers = Check.Valid=S.subjectAltName=IP:<remote-ip>

```

---

<div class="post-metadata">

**Author:** ![markus.pilman](https://sea1.discourse-cdn.com/foundationdb/user_avatar/forums.foundationdb.org/markus.pilman/32/379_2.png) [@markus.pilman](https://forums.foundationdb.org/u/markus.pilman)\
**Post date:** [May 2, 2022, 3:43pm UTC](https://forums.foundationdb.org/t/mtls-matching-ip-address/3291/2 "2022-05-02T15:43:09Z")

</div>

If you use TLS, this is not necessary as TLS prevents IP spoofing. Or in other words: TLS already does what you want to do here.

---

<div class="post-metadata">

**Author:** ![alexmiller](https://sea1.discourse-cdn.com/foundationdb/user_avatar/forums.foundationdb.org/alexmiller/32/326_2.png) [@alexmiller](https://forums.foundationdb.org/u/alexmiller)\
**Post date:** [May 12, 2022, 10:55pm UTC](https://forums.foundationdb.org/t/mtls-matching-ip-address/3291/3 "2022-05-12T22:55:34Z")

</div>

Spoofing is one side of this, which TLS does indeed prevent. There’s also a question of if a certificate is issued to one host, can it be moved and successfully reused by any other host. There was a previous question about this [TLS Plugin Automatic Hostname / IP Verification](https://forums.foundationdb.org/t/tls-plugin-automatic-hostname-ip-verification/1314) , and nothing has changed since afaik.